DarkSword Staging File Creation
Detects the creation of temporary files used by the DarkSword implant to stage stolen data before exfiltration. After exploiting the device, the DarkSword implants copy sensitive user data to temporary files. Detecting the creation of these specific staging files is a strong indicator of compromise.
Sigma
