Ccache Credential File Exfiltrated via SSH SCP

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects the exfiltration of Kerberos credential cache (ccache) files over SSH SCP. It specifically looks for the string "KRB5CCNAME" within TCP traffic on port 22 (SSH), indicating the potential transfer of a ccache file, which often contains this environment variable name.