AstarionRAT - High-Volume Exfiltration POST (T1041)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•4

Identifies AstarionRAT establishing HTTP POST connections to transmit the compressed archive containing the stolen browser and keylogger data. This rule correlates network HTTP POST requests with the creation of zip files by the same process, indicating potential data exfiltration.