Skip to content
Threat Feed

Vendor

Oracle

3 briefs RSS
high advisory

Multi-Cloud CLI Token and Credential Access via Command-Line Harvesting

This rule detects command-line activity indicative of credential access across multiple cloud platforms (GCP, Azure, AWS, GitHub, DigitalOcean, Oracle, Kubernetes), looking for specific commands used to print or access tokens and credentials, flagging hosts where multiple cloud targets are accessed within a five-minute window, suggesting potential credential harvesting activity.

gcloud +6 credential-access cloud cli token-harvesting
3r 2t
medium threat

Kerberos Traffic from Unusual Process

Detects network connections to the standard Kerberos port from an unusual process other than lsass.exe, potentially indicating Kerberoasting or Pass-the-Ticket activity on Windows systems.

Elastic Defend +22 kerberoasting credential-access lateral-movement windows
2r 2t
medium advisory

Suspicious LSASS Process Access

This rule identifies suspicious access attempts to the LSASS process, potentially indicating credential dumping attempts by filtering out legitimate processes and access patterns to focus on anomalies.

Windows Defender +3 credential-access lsass windows
3r 1t