Cloud and AI Credential Harvesting via env/printenv or ~/.aws/credentials Access in Shell Session
Detects potential credential theft activity where a user or compromised process executes shell commands to inspect environment variables, AWS credential files, or project configuration files (e.g., .env) for sensitive secrets such as API keys and access tokens.
YARA-L
