Abyssos FM_ARCHIVE collection staging correlated with non-standard-port exfil
Correlates Abyssos file-collection/archival commands (GRABBER_START/FM_GET/FM_ARCHIVE/FM_ADDTOARCHIVE) — requiring at least 5 collected files before an archive — with a subsequent non-standard-port outbound connection within 30 minutes, consistent with staged exfiltration over the AES-GCM C2 channel.
Microsoft Sentinel (KQL)
