MinIO Default Credential Access & Credential File Retrieval

Arnold Chan@slaz

•updated Sep 15, 2026•0•0•2

Detects unauthorized access and data retrieval attempts from a MinIO object storage instance using default administration credentials (minioadmin:minioadmin). The rule monitors both command-line execution of MinIO client (mc) operations and network connections to MinIO service ports (9000/9001) that involve the use of the default credential pair.