Bulk parallel environment/credential secrets sweep for cloud, LLM API keys, and crypto wallets
Detects instances where command-line arguments contain sensitive patterns such as cloud provider API keys, secret access keys, environment variable files, or cryptographic seed phrases. The rule specifically flags hosts where multiple such suspicious commands are executed, indicating potential reconnaissance or credential theft activity.
Cortex XDR
