Cloud Provider Credential Exfiltration Attempt

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects attempts to exfiltrate cloud provider credentials or API keys via network requests using tools like 'curl' or 'wget'. Attackers commonly use these tools to send stolen secrets to attacker-controlled infrastructure after gaining initial access. Various supply chain attacks have been observed leveraging this technique to exfiltrate credentials from CI/CD environments and cloud workloads.

2026-10-18 00:00:00

None

b3d9e17f-5a2c-4e81-b04d-7f2c9a1d8e53

attack.exfiltration attack.t1041 attack.credential-access attack.t1552.001

Nextron Sigma feed only (private)