Miasma Worm Cloud Credential Theft - AWS IAM/STS/IMDS/Secrets Manager/SSM and Kubernetes Token Access
Detects suspicious process activity originating from common build and package management tools (node, npm, bun, npx) that targets sensitive cloud and container credential locations, such as AWS IMDS, AWS configuration files, Kubernetes service account tokens, and HashiCorp Vault secrets. This rule is designed to identify malicious post-installation scripts or build processes attempting to exfiltrate credentials from developer or CI/CD environments.
Microsoft Sentinel (KQL)
