Bash script harvesting FMC managed-device configs into archives
Detects the use of shell commands ('bash', 'sh') to interact with potential configuration backup files or files containing sensitive system information (e.g., 'show_running-config.txt', 'show_version.txt'). This behavior is indicative of an adversary staging or accessing configuration data on a compromised system or network device.
Microsoft Sentinel (KQL)
