Python Accessing Sensitive Cloud or Container Credentials

Ethan Andrews@eandrews

•updated Jun 10, 2026•5•0•14

Detects Python processes accessing sensitive credential paths, a common post-exploitation step for malicious ML models (e.g., CVE-2026-4372). The rule specifically looks for Python executables accessing paths commonly associated with cloud (AWS) or container (Kubernetes) credentials. It includes exclusions for known legitimate ML pipeline scripts to reduce noise.