Redis Hgetall Apikey Live Hash

Detects execution of the Redis HGETALL command against a hash key following the pattern apikey:sk_live_<32 hex>. This operation retrieves all fields and values stored within the targeted API key hash, indicating direct data extraction of a specific credential object. When the key structure resembles live API credentials (sk_live_), this behavior reflects targeted secret access rather than general enumeration. It is typically observed after prior key discovery activity (e.g., KEYS *) and represents active credential harvesting from a compromised or exposed Redis instance.