T1552.001 / ATT&CK

Windows Analytic 0856

Correlated file access to insecure credential files (e.g., *.env, *.xml, *.ps1) followed by suspicious process execution or authentication using retrieved credentials. Detected through Sysmon logs and Windows Security Event logs.

• WinEventLog:Sysmon EventCode=11
• WinEventLog:Sysmon EventCode=1
• WinEventLog:Security EventCode=4624, 4648

Linux Analytic 0857

File reads or process executions involving insecurely stored credential files (e.g., config files with password fields) by non-root or anomalous users followed by ssh authentication attempts.

• auditd:SYSCALL open/read of sensitive config or secret files
• auditd:EXECVE grep/cat/awk on files with password fields
• linux:syslog authentication success after file access

macOS Analytic 0858

Terminal-based grep or open of plist/config files containing credentials, correlated with Keychain or system login attempts.

• macos:unifiedlog grep/cat on files matching credential patterns
• macos:unifiedlog open/read of *.plist or .env files
• macos:unifiedlog Keychain or user login post-access

Containers Analytic 0859

Container processes accessing mounted secrets or configuration paths (e.g., /run/secrets, /mnt/config) followed by network access or credential use.

• ebpf:syscalls open/read on secret mount paths
• kubernetes:audit process execution involving curl, grep, or awk on secrets
• cni:netflow outbound connection to internal or external APIs

IaaS Analytic 0860

Access to local credential/config files (e.g., ~/.aws/credentials) followed by metadata API calls or cloud role assumptions.

• CloudTrail:GetObject sensitive credential files in buckets or local image storage
• AWS:CloudTrail command-line execution invoking credential enumeration
• AWS:CloudTrail sudden role assumption after credential file access