Cloud credential access shortly after terraform provider execution

Ibrahim Saud@tektrix

•updated 12 days ago•1•0•1

Detects the execution of terraform.exe or go.exe on developer hosts, which acts as a precursor to the malicious Terraform provider campaign (Graphalgo) that targets cloud credentials.