* [New] Potential Credential Discovery via Recursive Grep
Identifies recursive grep activity on Linux or macOS where the command line suggests hunting for secrets, credentials,
keys, tokens, or sensitive paths (for example .env, .git, .aws). Events are aggregated per host, user, parent process, and one-minute window, the rule surfaces activity only when at least three distinct grep command lines match in the same bucket, to reduce noise from one-off searches.
* Update credential_access_grep_recursive_credential_discovery.toml
* Update rules/cross-platform/credential_access_grep_recursive_credential_discovery.toml
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
* Update rules/cross-platform/credential_access_grep_recursive_credential_discovery.toml
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
* Update credential_access_grep_recursive_credential_discovery.toml
* Update credential_access_grep_recursive_credential_discovery.toml
---------
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
Samirbous
09a3c0c813