Kazuar - Classified Document Scraping & Egress (T1005)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•1

This rule detects rapid access to specific classified document types (.doc, .docx, .pdf, .xls) followed by network egress to identified C2 structures within a 5-minute window. It correlates file access events for sensitive document types with subsequent network connections initiated by the same process on the same device.