Archive Creation Followed by External Transfer
Staging data into an archive and then sending it out within a short window is a hallmark of exfiltration. Correlating the two events on the same device (archive, then a public network connection from a transfer tool within 2 hours) is much higher fidelity than either event alone. The result is summarised per archive event to avoid join row multiplication.
Microsoft Sentinel (KQL)
