IronWorm Multi-Path Credential Sweep and /proc/self/environ Enumeration

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects suspicious credential harvesting activities, specifically identifying processes performing a sweep of multiple sensitive configuration files (e.g., AWS, Kubernetes, SSH keys, npm, git) or processes accessing /proc/self/environ to enumerate environment variables for sensitive data.