Skip to content

Credential file harvesting

Named by 2 kept items in this workspace.

Search every workspace for Credential file harvesting. It matches the name as written, so it can find other things that share it.

The items that name it 2

  • StepSecurity + Endor Labs: Mini-Shai-Hulud Wave 2
    writeup2026-05-19

    Sweeps over 130 credential file patterns covering cloud (AWS, GCP, Azure, Terraform), SSH, dev tokens (npmrc, pypirc, netrc, git-credentials, docker config), Kubernetes/Vault, crypto wallets, chat/messaging apps, and AI tooling configs (Claude).

  • TeamPCP SAP CAP Attack
    writeup2026-05-06It is written here as Credential file harvesting (T1552.001-like).

    Reads 80+ credential file patterns: SSH keys, AWS ~/.aws/credentials, Azure ~/.azure/accessTokens.json, GCP application_default_credentials.json, Kubernetes ~/.kube/config, ~/.npmrc, ~/.gitconfig, ~/.git-credentials, ~/.docker/config.json, .env files, AI tool configs (~/.claude.json, ~/.claude/mcp.j

All techniques in this workspace.