Exfiltration Over Web Services
Details: Identifies non-browser processes communicating with Mega/S4 storage services, 0x0.st, or the Telegram Bot API, which may indicate data staging, exfiltration, or automation activity. Hypothesis: An adversary may leverage command-line tools or custom scripts to communicate with cloud storage services, anonymous file-sharing platforms, or Telegram Bot APIs in order to stage, automate, or exfiltrate stolen data from a compromised host.
Microsoft Sentinel (KQL)
