Which SIEM platforms have a THREAT-Ransomware-AffiliateExfilTooling detection rule?

df00tech provides THREAT-Ransomware-AffiliateExfilTooling (Ransomware-Affiliate Custom Exfiltration Tooling (StealBit & Exmatter)) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the THREAT-Ransomware-AffiliateExfilTooling detection?

The THREAT-Ransomware-AffiliateExfilTooling detection is rated critical severity with high confidence.

What are common false positives for THREAT-Ransomware-AffiliateExfilTooling?

Common false positives for THREAT-Ransomware-AffiliateExfilTooling include: Legitimate backup or DR replication software that batches file writes and connects to a single cloud/offsite target with many parallel streams — verify against known backup service account names and scheduled maintenance windows; Software installers and self-extracting archives that drop randomly-named temporary executables into AppData\Local\Temp — correlate with a code-signing check and absence of subsequent network fan-out; Database maintenance jobs (backup, index rebuild, log shipping) that touch many .bak/.mdf files in a short window on a database server — exclude known DBA service accounts and SQL Server Agent job hosts.

Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Ransomware-AffiliateExfilTooling.

Upgrade to Pro

THREAT-Ransomware-AffiliateExfilTooling

Ransomware-Affiliate Custom Exfiltration Tooling (StealBit & Exmatter)

Q: What data sources are required to detect Ransomware-Affiliate Custom Exfiltration Tooling (StealBit & Exmatter) (THREAT-Ransomware-AffiliateExfilTooling)?

Detecting Ransomware-Affiliate Custom Exfiltration Tooling (StealBit & Exmatter) requires the following data sources: Microsoft Defender for Endpoint (DeviceProcessEvents, DeviceFileEvents, DeviceNetworkEvents), Sysmon Event ID 1, 3, 11.

Exfiltration Last updated: July 15, 2026

Ransomware affiliates increasingly deploy purpose-built exfiltration utilities instead of general-purpose tools like rclone, separating the data-theft channel from the encryption payload's C2 infrastructure. StealBit, distributed by LockBit affiliates, is a standalone binary (originally HTTP/HTTPS-based, later versions moved to a raw multi-threaded TCP protocol) that is dropped with a randomized hex/GUID filename into ProgramData, AppData\Local\Temp, or Users\Public, then run with no command-line arguments. It enumerates local and mapped drives, filters for high-value file types (databases, documents, spreadsheets, credential stores), and spawns dozens of concurrent upload threads to a single hardcoded external host to maximize throughput before the encryptor executes. Exmatter, used by BlackMatter/Noberus, BlackCat/ALPHV, and BlackByte affiliates, is a .NET utility that prioritizes specific extensions (.sql, .mdf, .bak, .pdf, .doc/x, .xls/x, .rdp, .kdbx) and exfiltrates over SFTP, FTPS, or WebDAV to attacker-controlled infrastructure using credentials embedded in its configuration; several observed samples overwrite or truncate a subset of already-uploaded source files with random data immediately after a successful transfer, an anti-recovery and extra-leverage behavior distinct from the ransomware's own encryption routine. Both tools are typically staged and executed in the hours immediately preceding encryption, making the exfiltration phase a high-value, narrow detection window before impact.

What is THREAT-Ransomware-AffiliateExfilTooling Ransomware-Affiliate Custom Exfiltration Tooling (StealBit & Exmatter)?

Ransomware-Affiliate Custom Exfiltration Tooling (StealBit & Exmatter) (THREAT-Ransomware-AffiliateExfilTooling) maps to the Exfiltration tactic — the adversary is trying to steal data in MITRE ATT&CK.

This page provides production-ready detection logic for Ransomware-Affiliate Custom Exfiltration Tooling (StealBit & Exmatter), covering the data sources and telemetry it touches: Microsoft Defender for Endpoint (DeviceProcessEvents, DeviceFileEvents, DeviceNetworkEvents), Sysmon Event ID 1, 3, 11. The queries below are rated critical severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic: Exfiltration

Microsoft Sentinel / Defender

kusto

let TargetExtensions = dynamic([".sql", ".mdf", ".ndf", ".bak", ".pst", ".ost", ".doc", ".docx", ".xls", ".xlsx", ".pdf", ".rdp", ".kdbx"]);
let StagingDirs = dynamic(["\\ProgramData\\", "\\AppData\\Local\\Temp\\", "\\Users\\Public\\"]);
// Signal 1: GUID/hex-named executable launched from a staging directory with no command-line arguments (StealBit / Exmatter drop pattern)
let SuspiciousLoader = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FolderPath has_any (StagingDirs)
| where FileName matches regex @"^[0-9a-fA-F]{8}-?[0-9a-fA-F]{4}-?[0-9a-fA-F]{4}-?[0-9a-fA-F]{4}-?[0-9a-fA-F]{12}\.exe$"
    or FileName matches regex @"^[0-9a-fA-F]{16,32}\.exe$"
| where isempty(ProcessCommandLine) or ProcessCommandLine =~ strcat(FileName)
| extend Signal = "SuspiciousLoaderExec", RiskScore = 75
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, Signal, RiskScore;
// Signal 2: mass staging/enumeration of high-value file types by a single process in a short window
let MassFileStaging = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where FileName has_any (TargetExtensions)
| summarize DistinctFiles = dcount(FileName), Paths = make_set(FolderPath, 5) by DeviceName, AccountName = InitiatingProcessAccountName, InitiatingProcessFileName, bin(Timestamp, 10m)
| where DistinctFiles > 50
| extend Signal = "MassFileStaging", RiskScore = 65
| project Timestamp, DeviceName, AccountName, FileName = "(multiple)", FolderPath = "(multiple)", ProcessCommandLine = "", InitiatingProcessFileName, Signal, RiskScore;
// Signal 3: high fan-out outbound connections — StealBit's multi-threaded upload workers or Exmatter's FTPS/SFTP session bursts to one external host
let HighFanoutExfil = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where ActionType =~ "ConnectionSuccess"
| where RemoteIPType == "Public"
| where RemotePort in (443, 21, 990, 22)
| summarize ConnectionCount = count(), BytesSent = sum(SentBytes) by DeviceName, AccountName = InitiatingProcessAccountName, InitiatingProcessFileName, RemoteIP, RemotePort, bin(Timestamp, 10m)
| where ConnectionCount >= 20
| extend Signal = "HighFanoutExfilConnections", RiskScore = 85
| project Timestamp, DeviceName, AccountName, FileName = InitiatingProcessFileName, FolderPath = strcat(tostring(RemoteIP), ":", tostring(RemotePort)), ProcessCommandLine = strcat("Connections=", tostring(ConnectionCount), " BytesSent=", tostring(BytesSent)), InitiatingProcessFileName, Signal, RiskScore;
// Signal 4: file truncated/modified within minutes of an outbound transfer from the same process (Exmatter's post-upload self-corruption of source files)
let PostExfilCorruption = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType == "FileModified"
| where FileName has_any (TargetExtensions)
| join kind=inner (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemotePort in (21, 990, 22, 443)
    | where RemoteIPType == "Public"
    | project NetTime = Timestamp, DeviceName, NetProcess = InitiatingProcessFileName
  ) on DeviceName
| where (Timestamp - NetTime) between (0min .. 5min)
| where InitiatingProcessFileName =~ NetProcess
| extend Signal = "PostExfilFileCorruption", RiskScore = 90
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, FileName, FolderPath = FolderPath, ProcessCommandLine = "", InitiatingProcessFileName, Signal, RiskScore;
union SuspiciousLoader, MassFileStaging, HighFanoutExfil, PostExfilCorruption
| sort by RiskScore desc, Timestamp desc

Four-signal detection for purpose-built ransomware-affiliate exfiltration tooling using Microsoft Defender for Endpoint telemetry: (1) a randomly-named executable launched with no arguments from ProgramData, AppData\Local\Temp, or Users\Public — the drop pattern shared by StealBit and Exmatter; (2) mass creation/modification/renaming of high-value file types (databases, documents, credential stores) by one process, indicating pre-exfiltration staging; (3) an unusually high count of outbound connections from a single process to one external host on FTPS/SFTP/HTTPS ports within a 10-minute window, matching StealBit's multi-threaded upload workers; (4) a file matching a target extension being modified within five minutes of an outbound transfer from the same process — Exmatter's documented post-upload source-file corruption behavior.

critical severity high confidence

Data Sources

Microsoft Defender for Endpoint (DeviceProcessEvents, DeviceFileEvents, DeviceNetworkEvents) Sysmon Event ID 1, 3, 11

Required Tables

DeviceProcessEvents DeviceFileEvents DeviceNetworkEvents

False Positives

Legitimate backup or DR replication software that batches file writes and connects to a single cloud/offsite target with many parallel streams — verify against known backup service account names and scheduled maintenance windows
Software installers and self-extracting archives that drop randomly-named temporary executables into AppData\Local\Temp — correlate with a code-signing check and absence of subsequent network fan-out
Database maintenance jobs (backup, index rebuild, log shipping) that touch many .bak/.mdf files in a short window on a database server — exclude known DBA service accounts and SQL Server Agent job hosts
File synchronization clients (OneDrive, SharePoint sync) that both upload and subsequently update local file metadata, which can superficially resemble the post-transfer modification pattern

Splunk

spl

(index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\ProgramData\\*" OR Image="*\\AppData\\Local\\Temp\\*" OR Image="*\\Users\\Public\\*")
  CommandLine="")
| regex Image="(?i)\\\\([0-9a-f]{8}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{12}|[0-9a-f]{16,32})\.exe$"
| eval Signal="SuspiciousLoaderExec", RiskScore=75
| table _time host User Image CommandLine Signal RiskScore
| append
    [ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3 DestinationPort IN (443,21,990,22)
      | stats count AS ConnectionCount BY host, User, Image, DestinationIp, DestinationPort, _time span=10m
      | where ConnectionCount>=20
      | eval Signal="HighFanoutExfilConnections", RiskScore=85
      | table _time host User Image DestinationIp DestinationPort ConnectionCount Signal RiskScore ]
| append
    [ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
      (TargetFilename="*.sql" OR TargetFilename="*.mdf" OR TargetFilename="*.bak" OR TargetFilename="*.pst" OR TargetFilename="*.pdf" OR TargetFilename="*.docx" OR TargetFilename="*.xlsx" OR TargetFilename="*.rdp" OR TargetFilename="*.kdbx")
      | stats dc(TargetFilename) AS DistinctFiles BY host, User, Image, _time span=10m
      | where DistinctFiles>50
      | eval Signal="MassFileStaging", RiskScore=65
      | table _time host User Image DistinctFiles Signal RiskScore ]
| sort - RiskScore - _time

SPL detection for StealBit/Exmatter-style ransomware-affiliate exfiltration tooling. Combines Sysmon process creation (EventCode=1) for randomly-named argument-less loaders dropped in staging directories, Sysmon network connection (EventCode=3) for high fan-out FTPS/SFTP/HTTPS connections from a single process, and Sysmon file creation (EventCode=11) for mass staging of high-value file extensions within a 10-minute window.

critical severity high confidence

Data Sources

Sysmon via Windows Event Log

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives

Backup agents opening many concurrent FTPS/SFTP sessions to a single offsite target during a scheduled window
Software installers dropping randomly-named temporary executables in AppData\Local\Temp with no arguments
SQL Server maintenance plans touching a large number of .bak/.mdf files within a short window

IBM QRadar (AQL)

sql

SELECT
    DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
    hostname AS Hostname,
    username AS User,
    "Process Name" AS ProcessName,
    "Command Line" AS CommandLine,
    destinationip AS DestinationIP,
    destinationport AS DestinationPort,
    LOGSOURCETYPENAME(logsourceid) AS LogSourceType,
    'SuspiciousLoaderOrFanout' AS ThreatType
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND (
    (
        "Process Name" MATCHES '.*\\\\(ProgramData|AppData\\\\Local\\\\Temp|Users\\\\Public)\\\\.*'
        AND (
            "Process Name" MATCHES '.*[0-9a-fA-F]{8}-?[0-9a-fA-F]{4}-?[0-9a-fA-F]{4}-?[0-9a-fA-F]{4}-?[0-9a-fA-F]{12}\.exe$'
            OR "Process Name" MATCHES '.*[0-9a-fA-F]{16,32}\.exe$'
        )
        AND ("Command Line" IS NULL OR "Command Line" = '')
    )
    OR (
        destinationport IN (443, 21, 990, 22)
        AND qidname(qid) = 'Firewall Permit'
    )
  )
  AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LIMIT 500

QRadar AQL query detecting StealBit/Exmatter-style ransomware-affiliate exfiltration tooling. Identifies argument-less, randomly-named executables launched from ProgramData, AppData\Local\Temp, or Users\Public via WinCollect-sourced Sysmon/Security events, and correlates against permitted outbound connections on FTPS/SFTP/HTTPS ports recorded by firewall log sources. Requires the 'Process Name' and 'Command Line' custom event properties to be extracted from the Windows/Sysmon DSM.

high severity medium confidence

Data Sources

IBM QRadar SIEM Microsoft Windows Security Event Log (via WinCollect) Sysmon Events (via WinCollect or Universal DSM) Firewall permit logs

Required Tables

events

False Positives

Software installers dropping randomly-named temp executables in AppData\Local\Temp with no command-line arguments — suppress by whitelisting signed installer hashes in a QRadar reference set
Backup/replication jobs generating regular firewall-permitted outbound connections on 443/21/990/22 to known offsite targets — populate a reference set of authorized destination IPs and exclude matching destinationip values

Sumo Logic CSE

sql

(_sourceCategory="windows/sysmon" OR _sourceCategory="endpoint/windows/sysmon") EventCode=1
  (Image matches "*\\ProgramData\\*" OR Image matches "*\\AppData\\Local\\Temp\\*" OR Image matches "*\\Users\\Public\\*")
  CommandLine=""
| where Image matches "*[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]*.exe"
| eval Signal="SuspiciousLoaderExec", RiskScore=75
| fields _messagetime, ComputerName, User, Image, CommandLine, Signal, RiskScore
| union (
    (_sourceCategory="windows/sysmon" OR _sourceCategory="endpoint/windows/sysmon") EventCode=3
    (DestinationPort=443 OR DestinationPort=21 OR DestinationPort=990 OR DestinationPort=22)
    | timeslice 10m
    | count AS ConnectionCount BY ComputerName, User, Image, DestinationIp, DestinationPort, _timeslice
    | where ConnectionCount>=20
    | eval Signal="HighFanoutExfilConnections", RiskScore=85
    | fields _timeslice, ComputerName, User, Image, DestinationIp, DestinationPort, ConnectionCount, Signal, RiskScore
  )
| sort by RiskScore desc

Sumo Logic search combining Sysmon process creation (EventCode=1) for randomly-named, argument-less loaders dropped in common staging directories with Sysmon network connection (EventCode=3) events showing high fan-out to a single destination on FTPS/SFTP/HTTPS ports within a 10-minute timeslice, matching the StealBit/Exmatter exfiltration pattern.

high severity medium confidence

Data Sources

Sumo Logic Cloud SIEM Windows Sysmon (via Sumo Logic Installed Collector)

Required Tables

_sourceCategory=windows/sysmon

False Positives

Installer temp binaries that momentarily match the random-name pattern but show no subsequent network fan-out — suppress by requiring correlation with the HighFanoutExfilConnections signal before alerting
Backup jobs producing regular connection bursts to a known offsite IP — maintain a Sumo Logic lookup table of authorized backup destination IPs and exclude matches from DestinationIp

Google Chronicle / SecOps

yaral

rule ransomware_affiliate_exfil_tooling {
  meta:
    author = "df00tech"
    description = "Detects StealBit/Exmatter-style ransomware-affiliate exfiltration tooling via loader drop and network fan-out"
    severity = "HIGH"
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1048.002"
    threat_actors = "LockBit, BlackMatter, BlackCat/ALPHV, BlackByte"
    reference = "https://attack.mitre.org/techniques/T1048/002/"

  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($proc.target.process.file.full_path, `(?i)\\(ProgramData|AppData\\Local\\Temp|Users\\Public)\\`)
    (
      re.regex($proc.target.process.file.full_path, `(?i)[0-9a-f]{8}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{12}\.exe$`)
      or re.regex($proc.target.process.file.full_path, `(?i)[0-9a-f]{16,32}\.exe$`)
    )
    $net.metadata.event_type = "NETWORK_CONNECTION"
    $net.target.port = 443 or $net.target.port = 21 or $net.target.port = 990 or $net.target.port = 22
    $proc.principal.hostname = $net.principal.hostname

  match:
    $proc.principal.hostname over 15m

  condition:
    $proc and $net
}

Chronicle YARA-L 2.0 rule matching PROCESS_LAUNCH and NETWORK_CONNECTION UDM events within a 15-minute window per host, detecting a randomly-named argument-less executable dropped in a common staging directory followed by an outbound connection on an FTPS/SFTP/HTTPS port — the shared drop-and-transfer pattern for StealBit (LockBit) and Exmatter (BlackMatter/BlackCat/BlackByte affiliates).

high severity medium confidence

Data Sources

Google Chronicle SIEM Chronicle UDM (Unified Data Model) Chronicle Forwarder (Windows Events)

Required Tables

UDM Events (PROCESS_LAUNCH, NETWORK_CONNECTION)

False Positives

Installer temp binaries with a single outbound connection for update/license checks — narrow the match window or require the HighFanoutExfilConnections-equivalent volume threshold before escalating
Authorized backup agents installed under ProgramData with legitimate scheduled outbound FTPS/SFTP connections — maintain a Chronicle reference list of authorized agent principal.process.file.full_path values and exclude matches

Sigma rule & cross-platform mapping

The detection logic for Ransomware-Affiliate Custom Exfiltration Tooling (StealBit & Exmatter) (THREAT-Ransomware-AffiliateExfilTooling) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource:

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for THREAT-Ransomware-AffiliateExfilTooling Sigma rules on detection.fyi

Platform-specific guides for THREAT-Ransomware-AffiliateExfilTooling

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)

Last updated: 2026-07-15 Research depth: deep

References (3)

Testing Methodology

Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Simulate StealBit-Style Multi-Threaded Exfil Fan-Out
Expected signal: Sysmon Event ID 1 for a randomly-named executable created in ProgramData; Sysmon Event ID 3 showing 20+ outbound connections to the test endpoint on port 443 within a short window.
Test 2Simulate Exmatter-Style Staging and Post-Upload File Corruption
Expected signal: Sysmon Event ID 11 for 60 file creations matching the .pdf extension within a short window; Sysmon Event ID 3 for the outbound SFTP connection on port 22; a second Event ID 11/2 for the modification of staged_1.pdf within minutes of the SFTP connection.

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock playbooks & atomic tests with Pro

Get the full detection package for THREAT-Ransomware-AffiliateExfilTooling — response playbook and atomic red team tests, plus investigation guidance and hunting queries.

df00tech Pro — £29/user/month

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Related Detections

Ransomware-Affiliate Custom Exfiltration Tooling (StealBit & Exmatter)

What is THREAT-Ransomware-AffiliateExfilTooling Ransomware-Affiliate Custom Exfiltration Tooling (StealBit & Exmatter)?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for THREAT-Ransomware-AffiliateExfilTooling

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock playbooks & atomic tests with Pro

Related Detections

Tactic Hub

Parent Technique

Related Techniques

Same Tactic: Exfiltration

Popular Detections

What is THREAT-Ransomware-AffiliateExfilTooling Ransomware-Affiliate Custom Exfiltration Tooling (StealBit & Exmatter)?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for THREAT-Ransomware-AffiliateExfilTooling

Testing Methodology

Unlock playbooks & atomic tests with Pro

Related Detections

Tactic Hub

Parent Technique

Related Techniques

Same Tactic: Exfiltration

Popular Detections

Get new detections in your inbox