Elastic Defend high stable eql

Cloud Credential Files Accessed by Process in Suspicious Directory

Identifies an untrusted or unsigned process accessing cloud credential and configuration files. Adversaries may attempt to access these files in order to gain access to sensitive data, laterally move or gain initial access into a cloud environment.

View Source

Detection Logic

file where event.action == "open" and 
 file.path like~ ("/Users/*/.aws/*", "/Users/*/.config/gcloud/credentials.db", "/Users/*/.azure/*") and
 Effective_process.executable != null and
 (Effective_process.executable like~
                                 ("/Users/Shared/*",
                                  "/Users/*/Public/*",
                                  "/private/tmp/*",
                                  "/tmp/*",
                                  "/var/root/*",
                                  "/Library/WebServer/*",
                                  "/Library/Graphics/*",
                                  "/Library/Fonts/*",
                                  "/private/var/root/Library/HTTPStorages/*",
                                  "/private/var/root/Library/*") or
  process.executable like~ ("/Users/Shared/*",
                            "/Users/*/Public/*",
                            "/private/tmp/*",
                            "/tmp/*",
                            "/var/root/*",
                            "/Library/WebServer/*",
                            "/Library/Graphics/*",
                            "/Library/Fonts/*",
                            "/private/var/root/Library/HTTPStorages/*",
                            "/private/var/root/Library/*")) and
 not process.name like~ "python*" and
 not process.executable like ("/opt/homebrew/*", "/usr/local/Cellar/*") and 
 not (process.executable like ("/private/tmp/claude-*/go-build*.test", 
      "/private/tmp/*/.terraform/providers/registry.opentofu.org/hashicorp/aws/*/terraform-provider-aws",
      "/private/tmp/*/.terraform/providers/registry.terraform.io/hashicorp/aws/*/terraform-provider-aws*",
      "/private/tmp/f2-agentcore-*/bin/Debug/net*/f2-agentcore-*") and file.name in ("credentials", "config")) and 
 not Effective_process.executable in ("/Applications/Cursor.app/Contents/MacOS/Cursor")

Field Validations

Loading…

Comments (0)

Loading comments...