VVS Stealer Vault Archive Followed by Discord Network Activity
This rule detects the creation of a '_vault.zip' archive, which is characteristic of the VVS Stealer malware, followed by network activity to Discord from the same process within a 15-minute window. VVS Stealer uses these archives to store stolen browser data (passwords, cookies, history, autofill) before exfiltrating it, often via Discord webhooks.
Microsoft Sentinel (KQL)
