Miasma/MYRA infostealer collecting AWS credentials and cloud secrets
This rule monitors for Node.js processes accessing sensitive configuration files, environment files, or credential stores (such as AWS credentials). It also triggers when command line arguments or file contents contain patterns indicative of infostealer activity, including specific indicators related to the Polymarket campaign or credentials collection functions like Git or Docker credential harvesting.
Splunk (SPL)
