cPGuard credential staging into hidden /var/tmp dir and archive per device

ills3c Intel&Coffee@Ills3C

•updated 6 days ago•3•0•9

Detects behavior where sensitive credential and configuration files (such as /etc/shadow, /etc/passwd, .ssh keys, my.cnf) are staged into a hidden /var/tmp directory and archived using commands like tar, cp, or gzip. Also matches specific sample-based indicators of compromise.