• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    HashiCorp Vault Token File Access

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Ethan Andrews@eandrews
    •updated Jun 2, 2026•3•0•15

    Detects attempts to read common HashiCorp Vault token paths from the filesystem, indicating potential credential harvesting by the Miasma stealer or other unauthorized access.

    Microsoft Sentinel (KQL)

    Tags

    TA0006 - Credential AccessT1528 - Steal Application Access TokenT1552.001 - Credentials In FilesFile AccessCredential AccessLinuxSyslog Generic Forwarderkql

    Found in

    • Miasma npm Campaign Targets Red Hat Cloud ServicesLast updated Jun 9, 2026

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?