Shell-based secret discovery with text-processing tools

gaurang k@gaurang7778

•updated Sep 1, 2026•5•0•12

This rule detects the use of command-line text-processing utilities (grep, awk, sed, etc.) to search for sensitive credential-related strings (e.g., secret, token, password) within environment files or process environments. This pattern is indicative of an adversary attempting to manually extract stored credentials from configuration files or system environment variables.