Stitch-SDK - Outbound SSL Bypass Exfiltration (T1567)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•4

Identifies Node.js initiating exfiltration connections to the C2 with parameters indicating disabled TLS certificate validation.