WinRAR archiving then WinSCP exfiltration, same host and user (Play)

ills3c Intel&Coffee@Ills3C

•updated 12 days ago•1•0•3

Detects data staging and exfiltration preceding Play double extortion: WinRAR/RAR adding files to an archive (recursive or password-protected) followed within 4 hours by a WinSCP transfer from the same host and user.