Sensitive File Discovery via Find Command

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects aggressive filesystem searches for credential, certificate, and wallet files using the 'find' command. This behavior may indicate an adversary attempting to locate sensitive files such as environment variable files, private keys, certificates, or wallet files that could be used for credential access or further compromise.

2026-08-07 00:00:00

None

e4c33ae7-6c3b-48fd-8e6f-a4d5e8636385

attack.credential-access attack.discovery attack.t1083 attack.t1552.001

Nextron Sigma feed only (private)