{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/amazon-web-services-aws/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Amazon Web Services (AWS)","Microsoft Azure","Google Cloud Platform (GCP)"],"_cs_severities":["medium"],"_cs_tags":["container","credential-access","discovery","cloud","linux"],"_cs_type":"advisory","_cs_vendors":["Amazon","Microsoft","Google"],"content_html":"\u003cp\u003eThis threat brief details the detection of malicious activity within containerized environments where an attacker actively searches for cloud credentials. Threat actors, upon gaining initial access to a container, leverage common Linux system utilities such as \u003ccode\u003egrep\u003c/code\u003e, \u003ccode\u003efind\u003c/code\u003e, \u003ccode\u003ecat\u003c/code\u003e, \u003ccode\u003esed\u003c/code\u003e, or \u003ccode\u003eawk\u003c/code\u003e to scan for patterns indicative of AWS, Azure, or Google Cloud Platform credentials. This activity often occurs via shell processes like \u003ccode\u003ebash\u003c/code\u003e or \u003ccode\u003esh\u003c/code\u003e executing these search commands. The objective is to discover sensitive information, such as \u003ccode\u003eaws_access_key_id\u003c/code\u003e, \u003ccode\u003eAZURE_CLIENT_SECRET\u003c/code\u003e, or \u003ccode\u003eprivate_key\u003c/code\u003e from service accounts, which can then be used to escalate privileges, move laterally within the cloud environment, or execute a container breakout to compromise the underlying host or other cloud services. Early detection of such credential discovery attempts is critical to prevent broader cloud infrastructure compromise.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Container Compromise\u003c/strong\u003e: An attacker gains initial access to a running container, typically through exploiting a vulnerable application, misconfiguration, or exposed service.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eEstablish Container Access\u003c/strong\u003e: The attacker establishes persistent access or obtains a shell within the compromised container environment.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDiscovery of System Utilities\u003c/strong\u003e: The attacker identifies and confirms the availability of common Linux system search utilities (\u003ccode\u003egrep\u003c/code\u003e, \u003ccode\u003efind\u003c/code\u003e, \u003ccode\u003ecat\u003c/code\u003e, \u003ccode\u003esed\u003c/code\u003e, \u003ccode\u003eawk\u003c/code\u003e) within the container's file system.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCredential Search Execution\u003c/strong\u003e: The attacker executes these utilities, either directly or via a shell process (\u003ccode\u003ebash\u003c/code\u003e, \u003ccode\u003esh\u003c/code\u003e, \u003ccode\u003ezsh\u003c/code\u003e), specifying arguments designed to locate files or environment variables containing cloud credential patterns (e.g., \u003ccode\u003eaws_access_key_id\u003c/code\u003e, \u003ccode\u003eAZURE_CLIENT_SECRET\u003c/code\u003e, \u003ccode\u003eapplication_default_credentials.json\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCredential Acquisition\u003c/strong\u003e: The search commands successfully identify and extract sensitive cloud credentials from configuration files, metadata services, or environment variables present in the container.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCloud Privilege Escalation/Lateral Movement\u003c/strong\u003e: Using the acquired credentials, the attacker attempts to escalate privileges within the associated cloud environment or move laterally to access other cloud resources, services, or connected containers.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eContainer Breakout (Optional)\u003c/strong\u003e: In some advanced scenarios, the attacker may leverage the discovered credentials or further container vulnerabilities to perform a container breakout, gaining access to the underlying host operating system or other parts of the cloud infrastructure.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eImpact and Persistence\u003c/strong\u003e: The attacker achieves their final objective, which may include data exfiltration, resource manipulation, service disruption, or establishing persistence in the cloud environment.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful credential search and acquisition within a container can lead to severe consequences, including unauthorized access to sensitive data, compromise of cloud resources, and financial loss due to misuse of cloud accounts. Attackers can leverage these credentials to escalate privileges, move laterally across cloud services, deploy additional malicious infrastructure, or achieve a container breakout, impacting the underlying host and potentially the entire cloud tenant. The compromise of a single container can therefore serve as a gateway to broader cloud environment devastation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to your SIEM to detect attempts to search for cloud credentials within containers.\u003c/li\u003e\n\u003cli\u003eEnsure \u003ccode\u003eprocess_creation\u003c/code\u003e logs are collected from your container environments with \u003ccode\u003eproduct: linux\u003c/code\u003e to activate the rule above.\u003c/li\u003e\n\u003cli\u003eReview access controls for all cloud resources to ensure least privilege is applied, minimizing the impact of compromised credentials.\u003c/li\u003e\n\u003cli\u003eRegularly scan container images for embedded static credentials or misconfigurations that could lead to initial access or credential exposure.\u003c/li\u003e\n\u003cli\u003eImplement runtime defense for containers to monitor and block suspicious process execution as identified by the Sigma rule.\u003c/li\u003e\n\u003cli\u003eRotate cloud credentials frequently and use temporary credentials (e.g., IAM roles, managed identities) where possible to reduce the window of exposure for compromised long-lived credentials.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-29T12:30:54Z","date_published":"2026-07-29T12:30:54Z","id":"https://feed.craftedsignal.io/briefs/2026-07-cloud-cred-search-container/","summary":"An attacker using system search utilities like `grep` or `find` within a containerized environment to locate cloud credentials (AWS, Azure, GCP) indicates an attempt to gain unauthorized access to sensitive cloud resources or perform a container breakout to compromise the underlying cloud infrastructure.","title":"Cloud Credential Search in Containers Detected","url":"https://feed.craftedsignal.io/briefs/2026-07-cloud-cred-search-container/"}],"language":"en","title":"CraftedSignal Threat Feed - Amazon Web Services (AWS)","version":"https://jsonfeed.org/version/1.1"}