Detecting Stealer C2 Exfiltration of Credential Archives

After collection, stealers bundle logs into an archive, often in memory and sometimes on disk, and send it to the operator over HTTP(S) or a web service. Exfiltration volume is small compared with ordinary business uploads, so volume thresholds fail. What does not fail is context: who sent it, to where, how rare the destination is and what the process just did.

Signals at a Glance

Correlating the Archive and the Upload

The strongest detection ties the archive to the connection. Look for a process that created an archive and then made an outbound connection within minutes:

// Microsoft Defender (KQL) - archive created then outbound connection by the same process
let Archives = DeviceFileEvents
| where ActionType == "FileCreated"
| where FileName endswith ".zip" or FileName endswith ".rar" or FileName endswith ".7z"
| where FolderPath has_any ("\\AppData\\", "\\Temp\\", "\\ProgramData\\", "\\Users\\Public\\")
| where InitiatingProcessFolderPath has_any ("\\AppData\\", "\\Temp\\", "\\ProgramData\\", "\\Users\\Public\\")
| project DeviceId, ArchTime = Timestamp, FileName, InitiatingProcessId, InitiatingProcessFileName;
Archives
| join kind=inner (
    DeviceNetworkEvents
    | where ActionType == "ConnectionSuccess" and RemotePort in (80, 443, 8080)
    | project DeviceId, NetTime = Timestamp, RemoteIP, RemoteUrl, InitiatingProcessId
) on DeviceId, InitiatingProcessId
| where NetTime between (ArchTime .. ArchTime + 10m)
// tune/validate: exclude sanctioned backup and sync clients by signer

Destination Rarity and Proxy Hunting

When the archive never touches disk, fall back to the upload itself. At the proxy, find POSTs that carry a file body to destinations nobody in the organisation has used before:

index=proxy http_method=POST bytes_out>20000 NOT http_user_agent="Mozilla/5.0*"
| eval dest=coalesce(dest_host, dest_ip)
| stats count sum(bytes_out) AS out dc(src) AS sources min(_time) AS first BY dest, http_user_agent, http_content_type
| where sources=1 AND count<=3
| where match(http_content_type, "(?i)(zip|octet-stream|multipart)")
`comment("tune/validate: join with a 30-day destination baseline to keep only first-seen hosts")`

• Use a first-seen filter over a 30-day destination baseline; it removes most legitimate uploaders cheaply.
• Block uploads from user-writable binaries at the proxy where you can identify the process (EDR network containment or a process-aware proxy).
• Record the archive path and process so incident response can estimate which stores were collected.