AN0856
Analytic 0856
Windows
Correlated file access to insecure credential files (e.g., *.env, *.xml, *.ps1) followed by suspicious process execution or authentication using retrieved credentials. Detected through Sysmon logs and Windows Security Event logs.
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=1
WinEventLog:Security
EventCode=4624, 4648
[FileNamePattern]
Patterns like *.env, *credential* can be tuned to reduce noise or catch custom implementations
[ProcessAccessScope]
Defines scope of access (e.g., only untrusted parent processes or high-risk processes)
[TimeWindow]
Time delta between credential file access and use in logon attempt
AN0857
Analytic 0857
Linux
File reads or process executions involving insecurely stored credential files (e.g., config files with password fields) by non-root or anomalous users followed by ssh authentication attempts.
auditd:SYSCALL
open/read of sensitive config or secret files
auditd:EXECVE
grep/cat/awk on files with password fields
linux:syslog
authentication success after file access
[RegexPatterns]
Patterns like password, secret, token can be expanded or customized
[UserContextScope]
Scope of users monitored (e.g., root vs all users)
[TimeWindow]
Time between suspicious file access and credential use
AN0858
Analytic 0858
macOS
Terminal-based grep or open of plist/config files containing credentials, correlated with Keychain or system login attempts.
macos:unifiedlog
grep/cat on files matching credential patterns
macos:unifiedlog
open/read of *.plist or .env files
macos:unifiedlog
Keychain or user login post-access
[KeychainToolAccess]
Monitor unexpected use of security CLI or Keychain helper binaries
[FileTypeList]
Add or remove watched file types based on system usage
AN0859
Analytic 0859
Containers
Container processes accessing mounted secrets or configuration paths (e.g., /run/secrets, /mnt/config) followed by network access or credential use.
ebpf:syscalls
open/read on secret mount paths
kubernetes:audit
process execution involving curl, grep, or awk on secrets
cni:netflow
outbound connection to internal or external APIs
[SecretMountPaths]
Customize based on deployment structure (e.g., /mnt/, /run/secrets/)
[ProcessBaselineDeviation]
Tune anomaly scoring for container image deviations
AN0860
Analytic 0860
IaaS
Access to local credential/config files (e.g., ~/.aws/credentials) followed by metadata API calls or cloud role assumptions.
CloudTrail:GetObject
sensitive credential files in buckets or local image storage
AWS:CloudTrail
command-line execution invoking credential enumeration
AWS:CloudTrail
sudden role assumption after credential file access
[CredentialFilePattern]
Regex to match common credential files (e.g., *.aws/credentials, token.txt)
[RoleAssumptionScope]
Adjust scope of roles monitored (e.g., admin, service accounts)
[TimeWindow]
Correlation timing between file access and AssumeRole