WinSCP Scripted Exfiltration Chained with Prior WinRAR Staging (T1567.002)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects a sequence of activity where WinRAR is used to archive data, followed by the use of WinSCP to potentially exfiltrate that data, occurring on the same host within a 24-hour window.