Exfiltration of stolen credentials via edgeLog.txt POST to C2

Ibrahim Saud@tektrix

•updated Jul 2, 2026•6•0•7

Detects the creation of a specifically named exfiltration file ('edgeLog.txt') followed by an outbound network connection over port 443 originating from the same process storyline. This pattern is indicative of a process staging stolen data to disk and subsequently exfiltrating it over an encrypted channel to an external destination.