Mitre Atlas: AML.T0085.001 | Detection.FYI

GenAI Process Accessing Sensitive Files

Oct 1, 2026 · Domain: Endpoint OS: Linux OS: macOS OS: Windows Use Case: Threat Detection Tactic: Collection Tactic: Credential Access Data Source: Elastic Defend Resources: Investigation Guide Noise: Medium Performance: Normal Profile: Recommended Threat: Unauthorized AI Usage Rule Type: Event Correlation (EQL) Platform: Windows Platform: Linux Platform: macOS Domain: GenAI Mitre Atlas: AML.T0085 Mitre Atlas: AML.T0085.001 Mitre Atlas: AML.T0055 ·
Share on:

Detects when GenAI tools access sensitive files such as cloud credentials, SSH keys, browser password databases, or shell configurations. Attackers leverage GenAI agents to systematically locate and exfiltrate credentials, API keys, and tokens. Access to credential stores (.aws/credentials, .ssh/id_*) suggests harvesting, while writes to shell configs (.bashrc, .zshrc) indicate persistence attempts. Note: On linux only creation events are available. Access events are not yet implemented.

Read More