BitsTransfer Syncobs Payload Download
Detects the secondary staging mechanism used by the intermediate PowerShell script before the PhantomPull in-memory loader is executed. This rule specifically looks for PowerShell or PowerShell Core processes executing commands that utilize `Start-BitsTransfer` to download a file named `syncobs.exe`.
CQL
