AWS Credentials File Exposed via Web Server

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects HTTP requests that attempt to access the '.aws/credentials' file, which typically contains AWS access keys and secret keys. This indicates an attempt to discover or exfiltrate sensitive AWS credentials from a web server, potentially exposing cloud resources.