Identify code scanning tools looking for AWS credentials

Lacey Cochrane@NullVectorX

•updated Jan 7, 2026•12•2•309

This rule detects when known code scanning tools like Trufflehog, Gitleaks, or Gittyleaks attempt to read the AWS credentials file. This activity could indicate an adversary or an internal security tool searching for sensitive AWS access keys and tokens.