MinIO Bucket Enumeration via Default minioadmin:minioadmin Credentials

Duo Tech@duotech

•updated Jul 8, 2026•1•0•5

This rule detects unauthorized or suspicious access attempts to a MinIO storage service by monitoring network traffic for default credentials, specific API calls like 'ListBuckets', or access to sensitive paths like 'terraform-state'. It triggers when traffic either targets the 'minio.internal' hostname or the local loopback address on port 9000, specifically looking for common MinIO administrative indicators.