[probably_wrong]

I understand how one would use YARA rules to identify that there's a file in VirusTotal containing secrets. What I don't get is whether there's a way for an actor to actually get the content of that file.