Skip to content
Threat Feed

Product

Gcloud

2 briefs RSS
high advisory

Multi-Cloud CLI Token and Credential Access via Command-Line Harvesting

This rule detects command-line activity indicative of credential access across multiple cloud platforms (GCP, Azure, AWS, GitHub, DigitalOcean, Oracle, Kubernetes), looking for specific commands used to print or access tokens and credentials, flagging hosts where multiple cloud targets are accessed within a five-minute window, suggesting potential credential harvesting activity.

gcloud +6 credential-access cloud cli token-harvesting
3r 2t
high advisory

Suspicious Process Accessing Sensitive Identity Files via Auditd

This rule detects suspicious processes, such as copy utilities or scripting tools, accessing sensitive identity files on Linux systems, including Kubernetes tokens, cloud CLI configurations, and root SSH keys, indicating potential credential theft.

Elastic Agent Auditd Manager +4 credential-access linux auditd
3r 2t