Added Credentials to Existing Application

SigmaHQ Detections@sigmaHQ

•updated Aug 20, 2026•4•0•3

Detects when a new credential is added to an existing application. Any additional credentials added outside of expected processes could be a malicious actor using those credentials.