Cloud Provider Credential Dumping via Grep

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects attempts to discover cloud provider credentials by directly invoking 'grep' with cloud provider-specific patterns. Attackers commonly enumerate environment variables after gaining initial access to identify or steal credentials for further exploitation, such as lateral movement or data exfiltration. Various supply chain attacks have been also seen leveraging this technique to steal credentials.

2026-10-18 00:00:00

None

f2c1b84a-7e3d-4f05-a92c-8d1e5b0c6f29

attack.credential-access attack.t1552.001

Nextron Sigma feed only (private)