Credential File Access Attempt (EDR Graph)
This detection watches for attempts to open or read files that typically store passwords, keys, or authentication tokens. It relies on endpoint detection and response (EDR) telemetry at the system-call level, checking every 30 seconds for such access attempts.
How the attack works
An attacker who has gained access to a system, or malicious code running on it, tries to read local credential storage such as password files, key stores, or configuration files containing secrets. The detection watches file-read activity captured at the operating system/EDR level and flags cases where the target file matches known credential file locations or patterns. It does not describe how the attacker got onto the system, only that a credential-file read occurred. This is one step in a larger attack chain, not proof of successful theft or later use of the credentials.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- aeed6c47-bf96-5c29-81b7-a37cefb9b409-p
- Severity
- High
Why it matters
If the read succeeds and the file contains usable secrets, an attacker can reuse or escalate access with stolen credentials, potentially reaching other systems or accounts without needing to breach them separately.
What you can do
- →Restrict file permissions on credential stores so only necessary accounts and processes can read them.
- →Store secrets in a dedicated secrets manager or vault instead of plain files where possible.
- →Review any alert from this detection to confirm which process and user account performed the read and whether it was expected.
- →Rotate credentials immediately if an unexpected or unauthorized read is confirmed.