AWS and Anthropic API Key Harvesting via Env Enumeration or Credential File Access
This rule detects potential credential harvesting activities by monitoring for suspicious environment variable enumeration or unauthorized access to sensitive credential and configuration files (such as AWS credentials and .env files) by common command-line utilities. It is designed to identify post-compromise reconnaissance where an adversary attempts to extract cloud provider or AI API keys.
Sigma
