Turla STOCKSTAY STOCKTRADER screenshot collect-compress-exfil chain
Detects a sequence of events indicative of data exfiltration: an unknown process creates an image file in a temporary folder, followed by the creation of an archive file (ZIP/RAR) by the same or a related process within 10 minutes, and concludes with a successful outbound network connection to a non-private IP address from the same device.
Microsoft Sentinel (KQL)
