Linux Archive Staging Before SSH/SCP Exfiltration

Danny Y@zendannyy

•updated Jun 29, 2026•0•0•3

Hunting rule for tar archive creation of user home trees, common staging before scp/rsync exfiltration over SSH. Prioritize /tmp archives and remote copy in the same session.