• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    HashiCorp Vault Token File Access

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Tim Peck@timpeck
    •updated Jun 2, 2026•4•0•9

    Detects attempts to read common HashiCorp Vault token paths from the filesystem, indicating potential credential harvesting by malware like Miasma stealer.

    Microsoft Sentinel (KQL)

    Tags

    T1552.001 - Credentials In FilesTA0006 - Credential AccessFile AccessCredential AccessLinuxWindows Defender Atpkql

    Found in

    • Miasma npm Campaign Targets Red Hat Cloud ServicesLast updated Jun 9, 2026

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?