Linux process access to cloud credential files (AWS/Azure/GCP/K8s)

Ankit Mehta@Secvyn

•updated 22 days ago•1•0•5

Detects the use of standard Linux command-line utilities (e.g., cat, curl, vi) to read or reference sensitive cloud credential files or Kubernetes service account tokens. This behavior is a common indicator of credential theft or discovery activities following initial access to a Linux host.