IcedID Exfiltrated Archived File Creation

This analytic detects the creation of specific archived files, 'passff.tar' and 'cookie.tar', which are known indicators of IcedID malware exfiltrating sensitive browser information like history and cookies. The detection leverages Sysmon EventCode 11 to identify these file creations. This activity is critical as it signifies the potential compromise of sensitive user data, which could lead to further exploitation, data breaches, or escalation of attacker presence within the network.