GIFTEDCROOK Sensitive Document and VPN Config Staging (UAC-0226)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•3

This rule detects potential data staging activities by monitoring for specific file paths and filenames associated with unauthorized collection of sensitive data (such as VPN configs, password databases, and office documents). It triggers when processes not typically associated with these file types access or interact with sensitive directories and file extensions.