Credential access and exposure

Did the agent access or expose secrets?

See when agents read credentials and where copies appear. Teleport links secret access and plaintext exposure to recorded commands and output, so you can trace what happened.

Review the evidence See the classifier

Example shown: credential access in a recorded SSH session.

Teleport credential-access finding: the session read temporary AWS credentials and copied them to a collection file. The finding is marked for review with High risk.
A credential-access finding, linked to the recorded read and copy.

Follow the credential read and copy.

This SSH session created a temporary AWS credential file, read it and copied it to a collection file. The selected event links the copy to credential-access and staging findings.

  1. 0:10

    A credential file is created

    The session creates a credential file in a temporary .aws directory.

  2. 0:15

    The credentials are read

    The credential-access finding cites a successful cat command reading .aws/credentials.

  3. 0:17

    A collection copy is made

    A cp command writes collected-credentials.txt. The event reports a destination file size of 112 bytes.

The copy is local. The data-exfiltration finding flags collection as staging; no outbound transfer is shown. Check whether the credentials were valid and the task was approved.

Credential-access and data-exfiltration findings from the same Teleport session. The event detail connects the local credential copy to both findings.
Two findings connect credential access with the additional copy.
View the full SSH session screenshot
Full Teleport SSH session review, including the credential read and copy timeline, selected command, session summary and credential-access, data-exfiltration and secrets-exposed-inline matches.
The original session view, including the timeline and all matched classifiers.

See what the classifier looks for.

The built-in credential-access classifier reviews SSH, Kubernetes and database sessions for attempts to read or retrieve credentials and secrets. Duplicate it to adapt the criteria and choose what happens on a match.

Enabled built-in credential-access classifier for SSH, Kubernetes and databases. Its criteria cover credential reads and secret retrieval, with actions to emit an audit event, flag for review and raise risk to High.
Session kinds, criteria and match actions in one configuration. Scroll the screenshot horizontally to inspect it.

Credential Secret Access

SSH, Kubernetes and databases

Looks for attempts to read credentials, SSH keys, cloud credential files, secret stores or credential data. Routine non-secret file reads and queries against unrelated tables are excluded.

View detailed criteria

Identify attempts to read or retrieve credential material.

  • Reads of SSH private keys or files in ~/.ssh, including authorized_keys.
  • Reads of ~/.aws/credentials, ~/.aws/config or secret-bearing kubeconfigs.
  • Secret-store retrieval, environment output used to harvest secrets or queries against credential data.

Secrets Exposed Inline

Captured input, prompts and output

Looks for plaintext credentials in captured commands, prompts and output. Variable names, redacted values and access-key IDs alone are excluded.

View detailed criteria

Identify credentials that appear in plaintext in the recorded session.

  • Literal passwords or tokens in arguments, environment assignments, headers or URLs.
  • Private-key material or credentials pasted into a prompt or shown in output.

Evaluated after session summarization; findings are reviewed against the recording.

See classifier setup
View classifier activity and recent matches
Full credential-access classifier page with match activity and two recent SSH sessions, rated High and Critical, each linking to its recording.
Recent matches link back to the recordings that need review.

Turn the match into a review.

Open the original recording, establish the context and document the outcome.

  1. 01

    Confirm the material

    Check that the value is an actual credential and identify its owner and scope. Use the original evidence without copying the secret into tickets.

  2. 02

    Trace the exposure

    Follow the credential file, captured output and collection copy. Determine which people or systems could access each copy, and check for any later transfer.

  3. 03

    Resolve the finding

    Record the authorization context and follow your credential-handling process if exposure is confirmed. Refine criteria for routine non-secret reads.

See the session investigation workflow

Bring your investigation to Teleport Beams.

Explore session capture, classification and evidence review for your environment. Contact us about classifier availability and deployment requirements.

Launching November 9. Join the waitlist for launch updates.