Cloud & AI API Key Harvesting with Exfil Attempt - Post-Compromise (T1552)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•6

Detects unauthorized or suspicious processes reading sensitive credential files (AWS, .env, etc.) and subsequently initiating a successful network connection to an external destination within a 5-minute window. This behavior is a common indicator of credential exfiltration.