Outbound transfer to C2 following MiniBrowse/SIGHTGRAB/ADExplorer collection

Ibrahim Saud@tektrix

•updated Jul 2, 2026•7•0•11

Detects instances where known post-exploitation tools or techniques (AD Explorer snapshots, staging of screen captures in public directories, or credential stealer execution) are followed by successful outbound network connections from the same device within a 30-minute window. This behavior often correlates with the collection and subsequent exfiltration of sensitive information.