Bash Script Invoking Cloud CLI for Credential/Secret Harvesting

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•6

Detects the execution of cloud CLI tools (aws, az, gcloud) using Unix shells (bash, sh) to perform sensitive operations such as listing secrets, keys, or metadata, which may indicate credential discovery or exfiltration.