Miasma/MYRA: node.exe Reading SSH Keys and AWS Credentials from Developer Directories
This rule monitors for the Node.js process (node.exe or node) accessing common sensitive configuration files, SSH keys, cloud credentials, or environment files such as .ssh/id_rsa, .aws/credentials, .npmrc, and .docker/config.json. Such activity is often indicative of an adversary attempting to perform credential theft or environment discovery after gaining initial access via a compromised Node.js application.
Cortex XDR
