MinIO Default Credential Access & Credential File Retrieval

Arnold Chan@slaz

•updated Sep 15, 2026•2•0•4

Detects unauthorized access and data retrieval attempts from a MinIO object storage instance using default administration credentials (minioadmin:minioadmin). The rule monitors both command-line execution of MinIO client (mc) operations and network connections to MinIO service ports (9000/9001) that involve the use of the default credential pair.