Archive creation followed by upload to Backblaze B2 on same device

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•0•0•1

Detects potential data staging and exfiltration where sensitive or investigation-related files are compressed using archive utilities or PowerShell, followed closely by upload activities to Backblaze B2 cloud storage via CLI tools, rclone, or direct API connections.