medium advisory July 29, 2026

Sensitive File Compression Detected in Linux Containers for Credential Access

Elastic Defend for Containers detects the use of compression utilities like tar or zip within Linux containers to collect sensitive files such as SSH keys, AWS credentials, or system configurations, indicating potential credential access and data collection attempts by adversaries.

What's new

l1 added detection rule: Detect Suspicious Tool Installation in Linux Containers Jul 29, 13:01 via elastic
l1 added detection rule: Detect Suspicious Network Tool Launch in Linux Containers Jul 29, 12:47 via elastic
l1 new IOCs Jul 29, 12:41 via elastic

This brief describes a detection mechanism implemented by Elastic Defend for Containers aimed at identifying credential access and collection activities within Linux container environments. Adversaries often exploit compromised containers to locate and gather sensitive information, including cloud provider credentials (AWS, Azure, GCP), SSH keys, Docker configurations, and system configuration files (e.g., /etc/passwd, /etc/shadow). The detection focuses on the use of common compression utilities such as zip, tar, gzip, hdiutil, 7z, rar, 7zip, or p7zip, either executed directly or via shell processes (bash, sh, zsh), when their command-line arguments target known sensitive file paths. This activity signals an attacker's attempt to stage data for exfiltration after gaining access to a container. The detection was reintroduced with Elastic Stack version 9.3.0.

Attack Chain

Initial Access: An adversary gains unauthorized access to a Linux container instance, potentially through a vulnerable application, misconfiguration, or compromised credentials for a management interface.
Discovery: Within the compromised container, the adversary enumerates the file system to locate sensitive files containing credentials, configuration data, or other valuable information.
Collection - Locate Sensitive Data: The attacker specifically targets files and directories known to store credentials or critical system configurations, such as ~/.ssh/, ~/.aws/, ~/.docker/, /etc/passwd, /etc/shadow, or cloud-specific credential files (e.g., application_default_credentials.json).
Collection - Archive Sensitive Data: To consolidate and prepare for exfiltration, the adversary executes a compression utility (e.g., tar, zip, gzip, 7z) directly or via a shell script, specifying the previously identified sensitive files as input.
Staging: The compression utility creates an archive file containing the collected sensitive data, typically in a temporary or accessible location within the container's file system, ready for the next phase.
Exfiltration (Implied): The adversary then moves the compressed archive out of the container environment to an external command and control server or storage location, completing the data theft objective.

Impact

Successful sensitive file compression and subsequent exfiltration from a compromised container can lead to significant data breaches and further attacks. Attackers can leverage stolen SSH keys, cloud provider API credentials, or Docker configuration files to gain access to other systems, cloud resources, or orchestrate lateral movement within the victim's infrastructure. This can result in unauthorized cloud resource provisioning, data theft from cloud storage, disruption of services, and a broader compromise of the organization's environment, potentially incurring severe financial, reputational, and regulatory consequences.

Recommendation

Deploy the Sigma rule provided in this brief to your SIEM to detect suspicious compression activities targeting sensitive files within Linux containers.
Ensure Elastic Defend for Containers is properly configured and enabled on all Linux container hosts to collect process execution logs.
Review the investigation steps outlined in this brief for any triggered alerts to identify the container, process, and files involved.
Isolate affected containers immediately upon detection to prevent further data exfiltration or unauthorized access, as recommended in the remediation section.
Rotate any credentials (SSH keys, cloud API keys) potentially exposed by the collected sensitive files.

Detection coverage 3

Sensitive File Compression Detected via Defend for Containers

medium

Detects the use of compression utilities to collect known files containing sensitive information, such as credentials and system configurations, inside a Linux container.

sigma tactics: collection, credential_access techniques: T1005, T1552, T1552.001, T1560, T1560.001 sources: process_creation, linux

Detect Suspicious Network Tool Launch in Linux Containers

low

Detects commonly abused network utilities (e.g., nc, nmap, tcpdump) running inside Linux containers, which can be used for malicious purposes such as reconnaissance, monitoring, or exploitation. This rule covers direct execution and invocation via common shells.

sigma tactics: command_and_control, credential_access, discovery, reconnaissance techniques: T1040, T1046, T1105, T1595 sources: process_creation, linux

Detect Suspicious Tool Installation in Linux Containers

low

Detects the installation of common adversary tools (e.g., netcat, curl, python interpreters) using Linux package managers within container environments. This indicates potential post-exploitation activity like reconnaissance, ingress tool transfer, or C2 establishment.

sigma tactics: command_and_control, execution techniques: T1072, T1105 sources: process_creation, linux

Detection queries are available on the platform. Get full rules →

Indicators of compromise

filepath

Type	Value
filepath	/var/lib/kubelet/pki/

Affected

Vendors

Elastic

Products

Defend for Containers

Operating systems

Linux

References

MITRE ATT&CK

T1552 · TA0006

Unsecured Credentials

Credential Access

high

Identifies the use of a compression utility to collect known files containing sensitive information, such as credentials

T1005 · TA0009

Data from Local System

Collection

high

Identifies the use of a compression utility to collect known files containing sensitive information, such as credentials and system configurations

T1560 · TA0009

Archive Collected Data

Collection

high

Identifies the use of a compression utility to collect known files containing sensitive information, such as credentials and system configurations inside a container.

T1046 · TA0007

Network Service Discovery

Discovery

high

Network utilities like nc, nmap, dig, tcpdump, ngrep, telnet, mitmproxy, zmap can be used for malicious purposes such as network reconnaissance, monitoring, or exploitation.

T1105 · TA0011

Ingress Tool Transfer

Command and Control

high

Adversaries exploit network tools within containers for reconnaissance or lateral movement, leveraging utilities like `nc` or `nmap` to map networks or intercept traffic.

T1595 · TA0043

Active Scanning

Reconnaissance

high

Network utilities like nc, nmap, dig, tcpdump, ngrep, telnet, mitmproxy, zmap can be used for malicious purposes such as network reconnaissance, monitoring, or exploitation.

T1040 · TA0006

Network Sniffing

Credential Access

med

Network utilities like nc, nmap, dig, tcpdump, ngrep, telnet, mitmproxy, zmap can be used for malicious purposes such as network reconnaissance, monitoring, or exploitation.

T1072 · TA0002

Software Deployment Tools

Execution

high

This rule detects the installation of tools inside a container. An adversary may need to install additional software to enumerate the container, its environment, and move laterally within the environment. Example attacker pattern: after gaining a shell in a pod, they run apt/apk/pacman to add curl, netcat, or socat.