Credential File Theft from Agent Environment

Detects tools or agent instructions that access well-known credential files from the host environment. Attackers target files like ~/.aws/credentials, SSH private keys, Docker configs, and Kubernetes configs to gain lateral movement capabilities. When credential file access is combined with a network call, this strongly indicates exfiltration rather than legitimate local usage.

Response Actions

References