AWS/Anthropic API Credential Harvesting from Developer Environment Post-Compromise

Ibrahim Saud@tektrix

•updated Jun 29, 2026•1•0•6

This rule detects potentially malicious command-line execution patterns aimed at harvesting sensitive credentials. It monitors for the access or searching of configuration files (e.g., AWS, .env, or Github tokens) and the dumping of environment variables that likely contain API keys or secrets, specifically targeting services like AWS, Anthropic, and GitHub.