Transfer Utilities Making Public Network Connections
Network-layer view of the tooling. It catches exfil where the command line is obfuscated, wrapped in a script, or the binary is renamed, and gives you destination context (IP, URL, port) for pivoting. BITS is excluded because transfers are performed by svchost.exe, not bitsadmin.exe.
Microsoft Sentinel (KQL)
