Developers and administrators keep long-lived secrets in files: SSH private keys, cloud CLI credentials, Git credential stores, kubeconfig files and password-manager databases. Stealers and hands-on-keyboard attackers search for the same names. You can audit the high-value files directly and hunt the discovery commands that precede theft.
Signals at a Glance
| Signal | Where | ATT&CK |
|---|---|---|
| Read of id_rsa, id_ed25519 or other private key files by an unexpected process | auditd, EDR file access | T1552.001 |
| Read of .aws/credentials, kubeconfig, .git-credentials or gcloud config | auditd, EDR file access | T1552.001 |
| Access to a KeePass .kdbx database or key file by a non-KeePass process | Security 4663, EDR | T1555.005 |
| Recursive search for *.kdbx, id_rsa, password or secret across user profiles | Process creation | T1083 |
| Copy of a .kdbx or key file to a staging or removable path | File events | T1005 |
Linux and macOS: Watching Key Files
On Linux, auditd watch rules on specific files generate a record for every read, with the process and user. Watch only the files that matter, because broad rules are noisy. Rules are per path, so generate them per user from your inventory:
# /etc/audit/rules.d/credential-files.rules (generate per user home from your inventory) -w /home/svc-deploy/.ssh/id_ed25519 -p r -k cred_ssh_key -w /home/svc-deploy/.aws/credentials -p r -k cred_aws -w /home/svc-deploy/.kube/config -p r -k cred_kube -w /home/svc-deploy/.git-credentials -p r -k cred_git # Hunt the resulting records ausearch -k cred_ssh_key -i --start today | aureport -f -i # tune/validate: ssh, aws and kubectl clients read these files legitimately; # alert on any other executable, and on reads outside the owner's login sessions
Windows and Discovery Hunting
On Windows, apply a SACL to the specific KeePass database and key files you can enumerate, and alert on any reader that is not the KeePass executable. Separately, hunt the discovery commands that look for secrets across profiles:
title: Search for Credential Files Across User Profiles
logsource:
category: process_creation
product: windows
detection:
selection_find:
CommandLine|contains:
- '*.kdbx'
- 'id_rsa'
- 'id_ed25519'
- '.aws\credentials'
- '.git-credentials'
selection_tool:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\where.exe'
- '\findstr.exe'
condition: selection_find and selection_tool
level: medium
# tune/validate: admins and backup scripts search for these names; scope by account
- Prefer short-lived cloud credentials (SSO, role assumption) over long-lived key files, so a stolen file expires quickly.
- Protect SSH keys with passphrases and agent forwarding controls, and store them in hardware-backed keys where possible.
- Alert on cloud-provider use of an access key from a new IP soon after a file-read alert; that closes the loop from theft to abuse.
Use SigmaHQ and Elastic rules for credentials in files, Splunk ESCU analytics for unsecured credential access, Linux auditd documentation and the MITRE ATT&CK T1552.001 and T1555.005 pages. Baseline which tools legitimately read these files before enabling file-read alerts broadly.
Build Detections That Fire
Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.
- Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
- Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
- 24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts