Cloud Provider Credential Dumping via Environment Variable Grep

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects attempts to discover cloud provider credentials stored in environment variables by using 'grep' with cloud provider-specific patterns (AWS, Google Cloud, GCloud, Azure). Attackers commonly enumerate environment variables after gaining initial access to identify or steal credentials for further exploitation, such as lateral movement or data exfiltration.

2026-05-28 00:00:00

None

a8f3d52b-4c1e-4d92-b81d-e6f2b09c3d47

attack.credential-access attack.t1552 attack.t1552.001

Nextron Sigma feed only (private)