Web Server Spawning Exfiltration and Staging Tools
Detects a web server process spawning tools commonly used for data staging and exfiltration, such as rar.exe, certutil.exe, and type.exe. This behavior is characteristic of the CL-UNK-1068 actor's exfiltration TTP, often performed via a web shell.
Sigma
