Archive Creation Followed by External Transfer

Awais Munir@iawais

•updated 2 days ago•3•1•7

Archiving then sending data out within a short window is a hallmark of exfiltration. Implemented with correlate() over three event sets: archive process → transfer-tool process → that same process's public connection, all on one aid within 2 hours.