Credential file staged, then sent
A credential file is read, archived or encoded, and what was staged from it is sent out.
Why it is risky
Section titled “Why it is risky”Archiving or encoding a credential before sending it is a common way to move a secret past simple filters, and a common shape in data exfiltration.
Example
Section titled “Example”An agent reads a cloud credentials file, base64-encodes it into a temporary file, and uploads the encoded file.
This is a fictional example, not an event from a customer.
What Omnodex Detects
Section titled “What Omnodex Detects”This advanced rule follows three calls in order: a read of a credential file, a staging step (archive, encode, encrypt or clipboard copy) that names that file, and a later call that sends what was staged to a host that is not the credential’s own service.
| Rule ID | Event category | Tier | Base severity |
|---|---|---|---|
RULE_ADV_CREDENTIAL_STAGED_SENT | credential_movement | Requires Pro | CRITICAL |
Base severity is the rule default. A finding involving content saved for later execution may have a lower severity. Your loaded rule version and event details determine the finding you see.
What to check next
Section titled “What to check next”Review all three calls together. Check where the staged file went, and rotate the credential if it reached a host you do not control. Remove any staged copies left on disk.
False positives
Section titled “False positives”A backup script may archive configuration that includes credentials and upload it to storage you own.
False negatives
Section titled “False negatives”Staging the tool does not recognize, a staged file renamed between steps, or steps split across sessions can be missed.
Technical details
Section titled “Technical details”The rule links the steps by the file paths each call names. It does not open the files, so it cannot confirm their content. This advanced rule produces evidence with the finding: each call in the chain with its role, a one-line summary of what it did, where the last call went, and why the chain might be routine. In the hosted dashboard, related findings about the same chain are read together as one investigation. Availability depends on the advanced rule bundle loaded by the installation. Findings on activity captured by agent hooks appear when the session ends or at the next background pass, within about 15 minutes; activity through the MCP proxy is judged as it is recorded.
A finding describes a pattern in captured activity. Review the original calls, their results, and the task context before concluding that harm occurred. Absence of a finding does not establish that an operation is safe.