Gryxa collect-forensics: log/task collection, archiving and upload from same pro

ills3c Intel&Coffee@Ills3C

•updated 4 days ago•0•0•1

Detects a specific sequence of behavior associated with Gryxa data collection and exfiltration. A single process queries system state or logs (scheduled tasks, WMI, event logs), creates an archive file (.zip, .7z, .rar), and establishes an outbound public network connection shortly thereafter.