3BB: Scripted recursive search for credentials, SSH keys, or DB strings

Arnold Chan@slaz

•updated Sep 15, 2026•0•0•0

This rule detects the use of common command-line utilities (grep, find, bash, sh, awk) to search for sensitive files, such as SSH keys, configuration files containing credentials, or password-related patterns. The rule includes exclusions for common administrative, security, and backup tools that might legitimately perform such scans.