Reconnaissance Tools Followed by Data Exfiltration

How the attack works

An attacker (or a compromised/manipulated agent) starts by running ordinary-looking commands like ls, find, cat, head, or env to explore the filesystem, list files, read file contents, and dump environment variables. This step identifies what data exists and where, including secrets that may be sitting in environment variables or config files. Once the recon step has run, the same session uses curl, wget, or nc to send data to an external destination. The rule flags sessions where this ordering happens: recon tools called first, exfiltration tools called afterward, based on the accumulated history of tool calls in that session.

Netzilo detection

Why it matters

An organization can lose sensitive files, credentials, or environment secrets that were discovered during recon and then sent to an attacker-controlled destination over the network.

What you can do

• →Review any flagged session's actual command arguments and destination URLs/IPs before treating it as malicious — recon-then-download is also normal in development workflows.
• →Restrict agent environments so sensitive credentials are not exposed via environment variables readable by the agent.
• →Limit or monitor outbound network tools (curl, wget, nc) available to agents that don't need internet access.
• →Apply egress filtering or allowlisting for outbound destinations from agent execution environments to make unauthorized exfiltration harder even if recon happens.

Known benign look-alikes

• Normal development workflows that browse filesystem then download packages

References

• https://attack.mitre.org/techniques/T1041/
• https://arxiv.org/abs/2403.04783

Related threats