Catalogue
ATT&CK

Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Search detections

Filters

Loading detections…

Loading detections

The public catalogue of detection rules. Every entry carries its source, the identifier it had there, its licence and its ATT&CK mapping.

Product

Catalogue ATT&CK Create a workspace

Trust

Security Privacy Licences Terms

Contact

Report a vulnerability Report a content issue contacto@detections.app

MediumElastic detection rules

First Time Python Accessed Sensitive Credential Files

Detects the first time a Python process accesses sensitive credential files on a given host. This behavior may indicate post-exploitation credential theft via a malicious Python script, compromised dependency, or malicious model file deserialization. Legitimate Python processes do not typically access credential files such as SSH keys, AWS credentials, browser cookies, Kerberos tickets, or keychain databases, so a first occurrence is a strong indicator of compromise.

ATT&CK coverage

Outside the enterprise matrix

T1539Steal Web Session Cookie 16 detections cover this technique
T1552Unsecured Credentials 110 detections cover this technique
T1552.001Credentials In Files 61 detections cover this technique
T1555Credentials from Password Stores 41 detections cover this technique
T1555.001Keychain 7 detections cover this technique
T1558Steal or Forge Kerberos Tickets 29 detections cover this technique
T1558.005Ccache Files 3 detections cover this technique

Detection requirements

Log source category: event_index

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.

Provenance

Where this detection came from, and what you may do with it.

At source: Open at source
Written by: Elastic
Licence: Elastic License 2.0Read the licence
Published: Aug 27, 2026
Version: 1