Sensitive Identity File Open by Suspicious Process via Auditd

Description

Detects Auditd opened-file reads on sensitive root and cluster paths (Kubernetes token mounts, kubelet and admin kubeconfig, PKI material, shadow, root SSH keys, root cloud CLI and Docker config) when the process looks like common copy or scripting utilities or the binary runs from temp or run staging. User home paths are excluded so file watches stay explicit and aligned with auditd.

Detection logic

Its licence does not clear it for publishing here

Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.

Detection requirements

Platform: Containers IaaS Identity Provider Linux macOS Network Devices Office Suite SaaS Windows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
Log source category: event_index

Known benign triggers

Administrators reading kubeconfig or cloud profiles during migration can match; correlate with change tickets and bastion sessions.
Backup, configuration management, and image scanners may open the same paths from scripted utilities; baseline trusted agents and narrow exclusions by process executable hash or parent chain.
Credential reads under non-root home trees are intentionally excluded; clone the rule with explicit per-user file.path values and optional process.executable prefixes if you must cover interactive accounts with matching audit -w lines for those paths.

References

Links the source published beside this detection. Reference is the link the source wrote, unmodified. Class is decided by this catalogue from the host and path, not stated by the source. Cited by counts published detections citing the same resource, including this one, and the sources beneath it count the repositories this catalogue ingests, which is not the same as independent research.
Reference	Class	Cited by
attack.mitre.org/techniques/T1552/001/	Taxonomy	3
attack.mitre.org/techniques/T1552/007/	Taxonomy	12

Detection rules

Sensitive Identity File Open by Suspicious Process via Auditd

Description

Detection logic

Detection requirements

Known benign triggers

MITRE ATT&CK mappings

References

From the source

Licence

Authorship

Detection rules