Parallel secret-sweeping for LLM API keys, cloud creds, and wallets
This rule monitors process command lines for strings associated with sensitive API keys (e.g., OpenAI, Alibaba, Huawei, Tencent, Aliyun) or seed phrases. It triggers an alert when two or more distinct patterns are identified on the same host, indicating potential credential harvesting or discovery activities.
Cortex XDR
