Phantom Stealer Multi-Channel Exfiltration via Telegram, Discord, FTP, SMTP from explorer.exe
Detects potential data exfiltration attempts initiated by 'explorer.exe' over common third-party services or protocols such as Telegram, Discord webhooks, FTP, or SMTP. This rule specifically looks for network connections made by 'explorer.exe' to known exfiltration channels, which is unusual behavior for the Windows Explorer process.
Microsoft Sentinel (KQL)
