Presigned URL backup download followed by API key search on same device

ills3c Intel&Coffee@Ills3C

•updated today•1•0•4

Detects potential data exfiltration and credential hunting where an endpoint downloads a database backup using presigned URLs or cloud storage signatures within 6 hours of searching local files for API keys or private keys.