Settings
You can configure parameters, exclusions, and matching rules for the Credential Discovery module with the Credential Discovery Settings page. The page has two tabs: General Settings and Matching Rules.
General Settings
You can configure Max Depth, Max File Size,Number of Characters Before Match ,Number of Characters After Match,Extensions, and Exclusions with General Settings.
Max Depth
Specifies the maximum folder depth that the Credential Discovery module will process.
Max File Size - KB
Specifies the maximum size of files that the Credential Discovery module will process.
Extensions
Specifies the file extensions that the Credential Discovery module will process.
Exclusions
Specifies what the Credential Discovery module will not process. Each exclusion has a type: IP, IP CIDR or IP Range exclude machines, and General excludes shares and folders with an IP Range, a Share Name Regex and a Folder Path Regex.
Number of Characters Before Match
Specifies the number of characters to include before the matching pattern in the processed data.
Number of Characters After Match
Specifies the number of characters to include after the matching pattern in the processed data.
Built-in Exclusions
In addition to the exclusions listed on this page, the collector always skips the following folders. These built-in exclusions apply to every share, are not shown on the page and cannot be changed:
.venv: Python virtual environment directories. These paths contain third-party dependencies and are not relevant for credential discovery.
node_modules: Node.js dependency directories. Automatically downloaded packages may cause noise and false positives.
WindowsApps: System-managed Windows application directories. These paths do not provide meaningful credential exposure findings.
Cortana: Cortana-related system folders. These directories are not relevant for credential discovery analysis.
Matching Rules
The Matching Rules tab lists the rules that decide which files are searched and what counts as a match. Use New Inclusion at the bottom of the tab to add a rule and Save to store the changes.
Inclusion Rule
Each matching rule is designated as an Inclusion. You can create matching rules with Name, Severity, Is Active, IP Range, Folder Path Regex, File Name Regex, and File Content Regex parameters.
A set of built-in inclusion rules comes preinstalled, for example Password in Powershell files. On a built-in rule only Severity and Is Active can be changed. Its other fields are read-only and it cannot be deleted.
Name
Name of the matching rule.
Severity
Risk level of matching rule: Critical, High, Medium, Low or Info.
Is Active
Status of the rule.
IP Range
Specifies the IP range of the machines to be scanned. IP range can be specified in formats such as 10.10.10.10, 8.8.8.0/24, or 6.6.6.20-82. If this field is empty, all machines will be scanned.
Folder Path Regex
Specifies the paths to be scanned based on the regex pattern. If this field is .* all folders will be scanned.
File Name Regex
Specifies the name of the files to be scanned based on the regex pattern. If this field is .* all files will be scanned.
File Content Regex
Specifies the regex pattern used to search for secrets in files. If this field is .* all data will be matched.
Exclusion Rule
Each matching rule can have multiple Exclusion Rules to filter the output. Open Exclusion Rules (N) on a rule and use New Exclusion to add one. You can create exclusion rules with Name, Is Active, IP Range, Folder Path Regex, File Name Regex, and File Content Regex parameters.
Name
Name of the exclusion rule.
Is Active
Status of the exclusion rule.
IP Range
Specifies the IP range of the machines to be excluded. IP range can be specified in formats such as 10.10.10.10, 8.8.8.0/24, or 6.6.6.20-82. If this field is empty, the exclusion applies to all machines.
Folder Path Regex
Specifies the paths to be excluded based on the regex pattern. If this field is .* all folders will be excluded.
File Name Regex
Specifies the name of the files to be excluded based on the regex pattern. If this field is .* all files will be excluded.
File Content Regex
Specifies the regex pattern used to exclude content. If this field is .* all data will be excluded.
Example
This matching rule finds the passwords between SQLSRV1.forestall.labs and SQLSRV100.forestall.labs. Machines between SQLSRV15.forestall.labs and SQLSRV33.forestall.labs and matches containing password=WqkgtnA134j are excluded from the rule.
Last updated
Was this helpful?