InvisibleFerret Reads Cloud CLI Credentials

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•1•0•6

Detects Python accessing AWS, Azure, Google Cloud, Kubernetes, Docker, Terraform, or Vault credential stores. This rule specifically looks for Python processes executing commands that contain keywords associated with cloud CLI credential files or configuration paths.