Archive sent to a new host
An archive is built and sent to a host the machine has never reached before.
Why it is risky
Section titled “Why it is risky”Packing up a directory, often a project’s source, and sending it to a host never contacted before is a simple way to copy code or data off a machine.
Example
Section titled “Example”An agent archives the current project and uploads the archive to an unfamiliar file drop.
This is a fictional example, not an event from a customer.
What Omnodex Detects
Section titled “What Omnodex Detects”This advanced rule fires when an archive is built and a later call sends it to a host that no call from this machine had reached before. Uploading release archives to a host you upload to regularly is not flagged.
| Rule ID | Event category | Tier | Base severity |
|---|---|---|---|
RULE_ADV_ARCHIVE_TO_NEW_HOST | data_movement | Requires Pro | MEDIUM |
Base severity is the rule default. A finding involving content saved for later execution may have a lower severity. Your loaded rule version and event details determine the finding you see.
What to check next
Section titled “What to check next”Check what was archived, where it went, and whether the upload was part of the task. If the host is unfamiliar and the archive held source or data, treat it as a possible leak.
False positives
Section titled “False positives”The first upload to a new, legitimate release or artifact host will match once.
False negatives
Section titled “False negatives”An archive sent to a host the machine has used before, or archiving the analyzer does not recognize, is not covered.
Technical details
Section titled “Technical details”The rule cannot see what the archive contains. It reports the order of the calls and the novelty of the destination. This advanced rule produces evidence with the finding: each call in the chain with its role, a one-line summary of what it did, where the last call went, and why the chain might be routine. In the hosted dashboard, related findings about the same chain are read together as one investigation. Availability depends on the advanced rule bundle loaded by the installation. Findings on activity captured by agent hooks appear when the session ends or at the next background pass, within about 15 minutes; activity through the MCP proxy is judged as it is recorded.
A finding describes a pattern in captured activity. Review the original calls, their results, and the task context before concluding that harm occurred. Absence of a finding does not establish that an operation is safe.