Credential directory collection
A command resembles archiving or recursively copying credential directories.
Why it is risky
Section titled “Why it is risky”Collecting several credential files into one place makes them easier to copy, share, or upload. The resulting archive may become a new sensitive artifact.
Example
Section titled “Example”An agent creates an archive containing SSH and cloud configuration directories as part of an unrelated support bundle.
This is a fictional example, not an event from a customer.
What Omnodex Detects
Section titled “What Omnodex Detects”The rule recognizes selected archive and recursive-copy command forms mentioning credential directories, including content saved into recognized staged files.
| Rule ID | Event category | Tier | Base severity |
|---|---|---|---|
RULE_THREAT_CREDENTIAL_ARCHIVE | threat_command | Community | HIGH |
Base severity is the rule default. A finding involving content saved for later execution may have a lower severity. Your loaded rule version and event details determine the finding you see.
What to check next
Section titled “What to check next”Inspect the source directories, archive destination, access controls, and any later transfer. Keep legitimate backups protected and exclude credentials from general support bundles.
False positives
Section titled “False positives”An approved encrypted backup or machine migration may match. An archive command that lists or extracts files can also match because the rule does not fully interpret command intent.
False negatives
Section titled “False negatives”Custom collectors, renamed files, other archive tools, or collection hidden inside a subprocess can be missed.
Technical details
Section titled “Technical details”This is a possible collection precursor. It does not establish that the archive contains usable secrets or was uploaded.
A finding describes a pattern in captured activity. Review the original call, its result, and the task context before concluding that harm occurred. Absence of a finding does not establish that an operation is safe.