Post-exploitation credential/secret file sweep (.env, AWS, wallet.dat)

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•4

This rule detects file access events targeting sensitive files such as credential stores, configuration files (e.g., .env, config.yaml, wallet.dat), and AWS credential files. This is indicative of an adversary searching for stored secrets or configuration data to facilitate further lateral movement or privilege escalation. The rule excludes common developer tools like code editors and file explorers to reduce noise.