AN1153
Analytic 1153
Windows
Unusual access to bash history, registry credentials paths, or private key files by unauthorized or scripting tools, with correlated file and process activity.
WinEventLog:Sysmon
EventCode=11
WinEventLog:Security
EventCode=4688
WinEventLog:Sysmon
EventCode=13, 14
[TimeWindow]
Defines the threshold time for accessing multiple sensitive files indicating automation.
[SuspiciousProcessList]
Process names to monitor (e.g., reg.exe, cmd.exe, powershell.exe, etc.)
AN1154
Analytic 1154
Linux
Reading of sensitive files like .bash_history, /etc/shadow, or private key directories by unauthorized users or unusual processes.
auditd:SYSCALL
open/read system calls to ~/.bash_history or /etc/shadow
auditd:SYSCALL
execution of tools like cat, grep, or awk on credential files
[SensitivePaths]
Paths to credential files such as /etc/shadow or ~/.bash_history
[UserContext]
Whether the process runs under a privileged or non-interactive session
AN1155
Analytic 1155
macOS
Unusual access to ~/Library/Keychains, ~/.bash_history, or Terminal command history by unauthorized processes or users.
macos:unifiedlog
read access to ~/Library/Keychains or history files by terminal processes
macos:unifiedlog
execution of 'security', 'cat', or 'grep' commands accessing credential storage
[ProcessName]
Tool or command used to query credentials (e.g., security, grep)
[TargetPath]
Credential file paths (e.g., ~/Library/Keychains)
AN1156
Analytic 1156
SaaS
Unusual web-based access or API scraping of password managers, single sign-on sessions, or credential sync services via browser automation or anomalous API tokens.
saas:googleworkspace
Accessed third-party credential management service
saas:zoom
unusual web session tokens and automation patterns during login
[TokenAnomalyThreshold]
Scoring threshold for access token entropy, reuse, or bot-like patterns
[AccessGeoLocation]
Region anomalies in SaaS portal access
AN1157
Analytic 1157
Identity Provider
Unauthorized API or console calls to retrieve or reset password credentials, download key material, or modify SSO settings.
azure:signinlogs
Reset password or download key from portal
AWS:CloudTrail
GetSecretValue
[SSOSettingScope]
Subset of IdP settings monitored for unauthorized changes
[SecretType]
Which secrets (passwords, keys, tokens) are monitored
AN1158
Analytic 1158
Containers
Access to container image layers or mounted secrets (e.g., Docker secrets) by processes not tied to entrypoint or orchestration context.
auditd:SYSCALL
read of /run/secrets or docker volumes by non-entrypoint process
containerd:Events
unusual process spawned from container image context
[EntrypointAllowlist]
Container entrypoints that are permitted to read secrets
[VolumeMountPath]
Paths to credentials/secrets inside container images
AN1159
Analytic 1159
Network Devices
Use of configuration backup utilities or CLI access to dump plaintext passwords, local user hashes, or SNMP strings.
linux:syslog
CLI access to 'show running-config', 'show password', or 'cat config.txt'
NSM:Flow
large transfer from management IPs to unauthorized host
[ManagementInterfaceIPs]
IP ranges authorized to perform credential dumps
[CommandPattern]
Regex patterns for suspicious CLI commands