Falco low stable other

Search Private Keys or Passwords

Detect attempts to search for private keys or passwords using the grep or find command. This is often seen with unsophisticated attackers, as there are many ways to access files using bash built-ins that could go unnoticed. Regardless, this serves as a solid baseline detection that can be tailored to cover these gaps while maintaining an acceptable noise level.

View Source

Detection Logic

spawned_process and ((grep_commands and private_key_or_password) or
     (proc.name = "find" and (proc.args contains "id_rsa" or
                              proc.args contains "id_dsa" or
                              proc.args contains "id_ed25519" or
                              proc.args contains "id_ecdsa"
      )
    ))

Field Validations

Loading…

Comments (0)

Loading comments...