API key / secret leakage

Cloud keys or tokens exposed in repos, CI logs, chat or gists

categoryIdentity, authentication and credential attacksdetectability (measured in our lab)Mediumlabdetected in lab

Example: tj-actions

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1552 · Search for Passwords in Powershell History · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1552 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1552 -TestGuids f9c3d0ab-479b-4019-945f-22ace2b1731a -TimeoutSeconds 120'

ATT&CK T1552 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1552 -Tool atomic -RunId run-2026-10-14-024 -Command 'Invoke-AtomicTest T1552 -TestGuids f9c3d0ab-479b-4019-945f-22ace2b1731a -TimeoutSeconds 120'

ATT&CK T1552 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1552 -Tool atomic -RunId run-2026-10-18-024 -Command 'Invoke-AtomicTest T1552 -TestGuids f9c3d0ab-479b-4019-945f-22ace2b1731a -TimeoutSeconds 120'

+ 2 more test variant(s) in the corpus.

What our lab measured

detected windows · 2026-10-30 · detected in 37s

What it looked like in telemetry

Log source	What it means
Sysmon · EID 1	PowerShell PSReadLine history (ConsoleHost_history.txt) searched for secrets or read across all users -- T1552
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
PowerShell · EID 4104	Powershell script querying system environment variables
PowerShell · EID 4104	Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104	Powershell script searching filesystem
PowerShell · EID 4104	Powershell script used "Invoke-command" cmdlet to execute sub script
Security · EID 4624	Non network or service local logon.
Security · EID 4634	Non service account logged off.
… and 4 more event type(s)

Detection that fired

✓ Wazuh 100442 (level 8) lab rule — PowerShell PSReadLine history (ConsoleHost_history.txt) searched for secrets or read across all users -- T1552
✓ Wazuh 100443 (level 8) lab rule — PowerShell PSReadLine history (ConsoleHost_history.txt) searched for secrets or read across all users (Security 4688 arm) -- T1552

Plus 10 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~5159 incidental alerts/hour — tune against this.

partially detected windows · 2026-10-27

What it looked like in telemetry

Log source	What it means
Sysmon · EID 1	Powershell process spawned powershell instance
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
PowerShell · EID 4104	Powershell script querying system environment variables
PowerShell · EID 4104	Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104	Powershell script searching filesystem
PowerShell · EID 4104	Powershell script used "Invoke-command" cmdlet to execute sub script
Security · EID 4624	Non network or service local logon.
Security · EID 4634	Non service account logged off.
… and 3 more event type(s)

Plus 11 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~69832 incidental alerts/hour — tune against this.

Classification

31 values: 7 reviewed, 2 lab-measured, 20 imported, 2 derived. What do these mean?

Exploitability

Attack vector	Credential attacksSoftware vulnerabilities
Attacker skill required	Low
Resources required	Low
Likelihood / prevalence	High
Maturity	Commoditized

Impact & scope

Platform	ContainersIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows
Environment	CloudOn-premises
Target asset class	Identity
Kill-chain phase (tactic)	Credential Access

Detection & telemetry

Detectability (measured in our lab)	Medium
Detectability (public detection content)	High
Noise level	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Application Log ContentCloud Service MetadataCommand ExecutionFile AccessFile CreationNetwork Traffic ContentProcess CreationUser Account AuthenticationWindows Registry Key Modification

Detection & response

Mitigated by 38

M1015 attack-mitigation
M1017 attack-mitigation
M1022 attack-mitigation
M1026 attack-mitigation
M1027 attack-mitigation
M1028 attack-mitigation
M1035 attack-mitigation
M1037 attack-mitigation
M1041 attack-mitigation
M1047 attack-mitigation
M1051 attack-mitigation
D3-AM d3fend
D3-ANCI d3fend
D3-CCSA d3fend
D3-CF d3fend
D3-CH d3fend
D3-CI d3fend
D3-CM d3fend
D3-CQ d3fend
D3-CR d3fend
D3-CRO d3fend
D3-CTS d3fend
D3-DF d3fend
D3-DI d3fend
D3-DUC d3fend
D3-FA d3fend
D3-FE d3fend
D3-FEV d3fend
D3-FIM d3fend
D3-LFP d3fend
D3-MFA d3fend
D3-NTPM d3fend
D3-RC d3fend
D3-RD d3fend
D3-RF d3fend
D3-RFAM d3fend
D3-RIC d3fend
D3-SCP d3fend

Detected by 59

DET0412 attack-detection-strategy
04936b66-3915-43ad-a8e5-809eadfd1141 sigma
05f3c945-dcc8-4393-9f3d-af65077a8f86 sigma
0aba5685-6db6-486f-88ef-29a99c545cfd sigma
0cf7a157-8879-41a2-8f55-388dd23746b7 sigma
0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6 sigma
1a0f6f16-2099-4753-9a02-43b6ac7a1fa5 sigma
1b45b0d1-773f-4f23-aedc-814b759563b1 sigma
1f978c6a-4415-47fb-aca5-736a44d7ca3d sigma
213d6a77-3d55-4ce8-ba74-fcfef741974e sigma
3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe sigma
44030449-b0df-4c94-aae1-502359ab28ee sigma
459a2970-bb84-4e6a-a32e-ff0fbd99448d sigma
47e4bab7-c626-47dc-967b-255608c9a920 sigma
508a9374-ad52-4789-b568-fc358def2c65 sigma
53b1b378-9b06-4992-b972-dde6e423d2b4 sigma
587254ee-a24b-4335-b3cd-065c0f1f4baa sigma
68fcba0d-73a5-475e-a915-e8b4c576827e sigma
6ad91e31-53df-4826-bd27-0166171c8040 sigma
6d3a3952-6530-44a3-8554-cf17c116c615 sigma
6ea858a8-ba71-4a12-b2cc-5d83312404c7 sigma
74298991-9fc4-460e-a92e-511aa60baec1 sigma
76a26006-0942-430b-8249-bd51d448f8e5 sigma
7892ec59-c5bb-496d-8968-e5d210ca3ac4 sigma
80eeab92-0979-4152-942d-96749e11df40 sigma
8344c19f-a023-45ff-ad63-a01c5396aea0 sigma
851fd622-b675-4d26-b803-14bc7baa517a sigma
87a476dc-0079-4583-a985-dee7a20a03de sigma
91a2c315-9ee6-4052-a853-6f6a8238f90d sigma
91b76b84-8589-47aa-9605-c837583b82a9 sigma
9cd55b6c-430a-4fa9-96f4-7cadf5229e9f sigma
9e716b33-63b2-46da-86a4-bd3c3b9b5dfb sigma
a61a3c56-4ce2-4351-a079-88ae4cbd2b58 sigma
aa7a3fce-bef5-4311-9cc1-5f04bb8c308c sigma
b094d9fb-b1ad-4650-9f1a-fb7be9f1d34b sigma
b2815d0d-7481-4bf0-9b6c-a4c48a94b349 sigma
b831353c-1971-477b-abb6-2828edc3bca1 sigma
b83f5166-9237-4b5e-9cd4-7b5d52f4d8ee sigma
bd5971a7-626d-46ab-8176-ed643f694f68 sigma
beaa66d6-aa1b-4e3c-80f5-e0145369bfaf sigma
… and 19 more in the database

Tested by 65

00e3e3c7-6c3c-455e-bd4b-461c7f0e7797 atomic
0d4f2281-f720-4572-adc8-d5bb1618affe atomic
0e56bf29-ff49-4ea5-9af4-3b81283fd513 atomic
114dd4e3-8d1c-4ea7-bb8d-8d8f6aca21f0 atomic
12e4a260-a7fd-4ed8-bf18-1a28c1395775 atomic
14575d1f-16b3-4a0b-8986-540e42e6a6cc atomic
18318786-e0c0-4bdf-979f-f022e6f5f2ef atomic
290df60e-4b5d-4a5e-b0c7-dc5348ea0c86 atomic
2951c09f-b4f9-4248-ba75-6373709ebd55 atomic
2a24627b-061b-43e6-bece-a5b0638841dd atomic
2a5a0601-f5fb-4e2e-aa09-73282ae6afca atomic
31e794c4-48fd-4a76-aca4-6587c155bc11 atomic
336b25bf-4514-4684-8924-474974f28137 atomic
367d4004-5fc0-446d-823f-960c74ae52c3 atomic
37807632-d3da-442e-8c2e-00f44928ff8f atomic
3cfde62b-7c33-4b26-a61e-755d6131c8ce atomic
42c55554-3dcb-4df6-8fbb-c8ccacc478d4 atomic
43c3a49d-d15c-45e6-b303-f6e177e44a9a atomic
46959285-906d-40fa-9437-5a439accd878 atomic
51cde30c-0311-449a-8e15-542b59f95939 atomic
520ce462-7ca7-441e-b5a5-f8347f632696 atomic
5312c7c3-775b-4437-a8b0-914b30cfebd4 atomic
5a668739-3a2f-4265-895f-c0e1e0b09eaa atomic
5e417277-0ae7-4ad5-a3e8-0fa27c122b29 atomic
75f66e03-37d3-4704-9520-3210efbe33ce atomic
7617f689-bbd8-44bc-adcd-6f8968897848 atomic
788e0019-a483-45da-bcfe-96353d46820f atomic
78b274f8-acb0-428b-b1f7-7b0d0e73330a atomic
78e95057-d429-4e66-8f82-0f060c1ac96f atomic
7c247dc7-5128-4643-907b-73a76d9135c3 atomic
864bb0b2-6bb5-489a-b43b-a77b3a16d68a atomic
870fe8fb-5e23-4f5f-b89d-dd7fe26f3b5f atomic
8f2765a8-e795-438b-a102-5e25a7adcce1 atomic
922b1080-0b95-42b0-9585-b9a5ea0af044 atomic
98618067-a2c7-4d4b-9c89-403a90f43656 atomic
9d9c22c9-fa97-4008-a204-478cf68c40af atomic
9e507bb8-1d30-4e3b-a49b-cb5727d7ea79 atomic
a11f22fb-a037-4cc2-bcfc-a133b287aa1b atomic
a21118de-b11e-4ebd-b655-42f11142df0c atomic
a8f6148d-478a-4f43-bc62-5efee9f931a4 atomic
… and 25 more in the database

Attack relationships

Child: AI coding-assistant config / key theft
Child: CA key theft / forged certs
Child: Cluster-to-cloud lateral movement
Child: Crypto private key theft
Child: Kubernetes API server abuse
Child: Metadata credential theft
Child: Secrets in ConfigMaps / env vars
Child: SSH key / private key theft
Child: SSRF to instance metadata
Child: Unsecured credentials

Lab findings

Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.

Run	Outcome	Tool	Platform	Ran at
`run-2026-10-14-024`	partially-detected	atomic	windows	2026-10-14
`run-2026-10-18-024`	partially-detected	atomic	windows	2026-10-18
`run-2026-10-27-023`	partially-detected	atomic	windows	2026-10-27
`run-2026-10-30-006`	detected	atomic	windows	2026-10-30

run-2026-10-14-024 — Backlog detectability-baseline probe (priority 5, 2 corpus attack(s); atomic_tests=2). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1552 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=14 max_level=15 dwell_s=90
run-2026-10-18-024 — Backlog detectability-baseline probe (priority 5, 2 corpus attack(s); atomic_tests=2). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1552 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=1513 max_level=15 dwell_s=90
run-2026-10-27-023 — Backlog detectability-baseline probe (priority 5, 2 corpus attack(s); atomic_tests=2). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1552 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=1804 max_level=15 dwell_s=90
run-2026-10-30-006 — Backlog detectability-baseline probe (priority 5, 2 corpus attack(s); atomic_tests=2). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1552 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=2 incidental=139 max_level=15 dwell_s=90

Framework references

Primary source: https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066
attack: T1552 (primary)
cve: CVE-2025-30066

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Identity, authentication and credential attacks' table, line 372 of Cyber-Attack-Taxonomy.md
ev-0002 (CISA Known Exploited Vulnerabilities Catalog) — CISA KEV lists CVE-2025-30066 as known-exploited (kev=1, ransomware=unknown); added 2025-03-18.
tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability
ev-0003 (FIRST EPSS scores) — FIRST EPSS for CVE-2025-30066: epss=0.69794 percentile=0.99337 (score date 2026-09-18).
ev-0004 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 6 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0005 (NVD CVE API 2.0) — NVD maps CVE-2025-30066 to weakness(es) CWE-506.
ev-0006 (NVD CVE API 2.0) — Example vulnerability CVE-2025-30066: NVD CVSS v3.1 base 8.6 (HIGH) [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N]. Not applied as facets: CVSS scores this one vulnerability, not the attack class.
ev-0007 (Phase 4 detection lab - detonation runs 2026-10-14) — Lab detonation run-2026-10-14-024 (partially-detected) for T1552: no alert matched the expected technique
ev-0008 (Phase 4 detection lab - detonation runs 2026-10-18) — Lab detonation run-2026-10-18-024 (partially-detected) for T1552: no alert matched the expected technique
ev-0009 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-023 (partially-detected) for T1552: no alert matched the expected technique
ev-0010 (Phase 4 detection lab - detonation runs 2026-10-30) — Lab detonation run-2026-10-30-006 (detected): Wazuh rule(s) 100442, 100443 fired on T1552 within the detonation window
PowerShell PSReadLine history (ConsoleHost_history.txt) searched for secrets or read across all users (Security 4688 arm) -- T1552