Find AWS Credentials

Description

Detect attempts to search for private keys or passwords using the grep or find command, particularly targeting standard AWS credential locations. This is often seen with unsophisticated attackers, as there are many ways to access files using bash built-ins that could go unnoticed. Regardless, this serves as a solid baseline detection that can be tailored to cover these gaps while maintaining an acceptable noise level. This rule complements the rule "Search Private Keys or Passwords".

Query · falco

spawned_process and ((grep_commands and private_aws_credentials) or
     (proc.name = "find" and proc.args endswith ".aws/credentials"))

Rule dependencies

Depends on

  • composes · Falco macro grep_commands
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro private_aws_credentials
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro spawned_process
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Detected AWS credentials search activity | proc_pcmdline=%proc.pcmdline proc_cwd=%proc.cwd group_gid=%group.gid group_name=%group.name user_loginname=%user.loginname evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Raw source Find AWS Credentials · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Find AWS Credentials
desc: 'Detect attempts to search for private keys or passwords using the grep or find
  command, particularly targeting standard AWS credential locations. This is often
  seen with unsophisticated attackers, as there are many ways to access files using
  bash built-ins that could go unnoticed. Regardless, this serves as a solid baseline
  detection that can be tailored to cover these gaps while maintaining an acceptable
  noise level. This rule complements the rule "Search Private Keys or Passwords".

  '
condition: "spawned_process and ((grep_commands and private_aws_credentials) or\n\
  \     (proc.name = \"find\" and proc.args endswith \".aws/credentials\"))\n"
output: Detected AWS credentials search activity | proc_pcmdline=%proc.pcmdline proc_cwd=%proc.cwd
  group_gid=%group.gid group_name=%group.name user_loginname=%user.loginname evt_type=%evt.type
  user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name
  proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
  exe_flags=%evt.arg.flags
priority: WARNING
tags:
- maturity_stable
- host
- container
- process
- aws
- mitre_credential_access
- T1552

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.