Bulk access to SSH keys, cloud CLI credentials, and .env files by unsigned unrecognized process
Detects an unsigned or unrecognized process performing read or modification operations on multiple types of credential stores (SSH keys, cloud CLI configurations, and environment variable files) within a short time frame. This behavior is indicative of credential harvesting or unauthorized looting of secrets from a developer workstation, similar to techniques used by stealer malware.
Microsoft Sentinel (KQL)
