UNC4841 - Email Exfiltration File Pattern

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•28

Detects the creation of files with a specific naming pattern '/mail/tmp/[a-zA-Z0-9]{3}[0-9]{3}.tar.gz' which has been observed to be used by the threat actor UNC4841 for staging and exfiltration of email-related data.