IronWorm Credential File Harvesting of AWS, AI API Keys, and Crypto Wallets
Detects rapid or aggregate access to multiple sensitive credential or configuration files across various applications (e.g., AWS, Docker, Kubernetes, Crypto wallets, AI tools) within a short timeframe. This behavior is indicative of credential harvesting or post-compromise reconnaissance to steal secrets and keys.
Microsoft Sentinel (KQL)
