GIFTEDCROOK: ZIP Staging of Stolen Credentials Followed by HTTPS Exfiltration
This rule detects a sequence of behaviors indicative of credential theft followed by data staging and exfiltration. It identifies processes accessing sensitive browser credentials or KeePass database files, followed by the creation of a ZIP archive within user profile directories, and concludes with an outbound HTTPS connection to a non-trusted, non-Microsoft external destination by the same process.
Microsoft Sentinel (KQL)
