What signals are strong enough to block access to local secrets?
Source Reddit Cybersecurity
Discussion
This is a discussion post on Reddit about a policy model designed to block or alert on access to local sensitive files based on multiple signals such as executable identity, parent process, launch path, access bursts, and cross-store behavior. The post links to an open-source implementation called stealerxhunter, which targets Linux and Windows systems. The author seeks feedback on which signals are strong enough to justify blocking access versus alerting only. There is no direct report of a vulnerability or exploit, but rather a conceptual approach to improving local secret protection.
r/cybersecurity (opens in a new tab)u/fakirage0 points0 comments
I see that the hard part isn’t identifying sensitive files...
It’s deciding whether the process accessing them is legitimate, especially when it runs as the same user and looks like normal software.
So, i’m testing a policy model (for linux/win) that combines executable identity, parent process, launch path, access bursts and cross-store behavior to choose between allow, alert and deny.
For context, the implementation is here:
https://github.com/Kjean13/stealerxhunter
Feedback, testing and code reviews are welcome, especially around fanotify, systemd integration and policy design.
Which signals would you trust enough for blocking, and which ones should stay alert-only?