Delayed Reuse of Previously Written Agent Memory File in Unrelated Future Session
Detects a sequence of file write operations followed by file read operations on specific files named 'AGENTS.md', 'MEMORY.md', 'IDENTITY.md', 'USER.md', or 'SOUL.md' with a significant time gap between the operations. This pattern is indicative of data staging, where an adversary writes sensitive information to a file and subsequently reads it for exfiltration.
Cortex XDR
