Product
high
advisory
Suspicious Process Accessing Sensitive Identity Files via Auditd
3 rules 2 TTPsThis rule detects suspicious processes, such as copy utilities or scripting tools, accessing sensitive identity files on Linux systems, including Kubernetes tokens, cloud CLI configurations, and root SSH keys, indicating potential credential theft.
Elastic Agent Auditd Manager +4
credential-access
linux
auditd
3r
2t
high
advisory
AWS AssumeRoleWithWebIdentity from Kubernetes SA and External ASN
2 rules 1 TTPDetects successful AWS `AssumeRoleWithWebIdentity` calls where the caller identity is a Kubernetes service account and the source autonomous system organization is not `Amazon.com, Inc.`, which may indicate a stolen or misused projected service-account token being exchanged for IAM credentials off-cluster.
EKS +1
aws
cloudtrail
iam
kubernetes
initial-access
web-identity
2r
1t