Linux Tar Archive Created for Data Staging via SSH

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•5

This rule detects the creation of a tar archive using the 'tar -czf' command, specifically when the archive is being created in the '/tmp/' directory over an SSH connection. This activity is indicative of data staging, where an attacker might be preparing data for exfiltration or further malicious use.