HEAVYGRAM Staged Exfil Files Under ZlibDate Directory
This rule detects file creation or modification events occurring within the 'ProgramData\ZlibDate' directory. This specific path and the associated file extensions (.Dat and .zip) are frequently associated with data staging activities or unauthorized file management by malicious software attempting to persist or exfiltrate data under the guise of legitimate application data.
Microsoft Sentinel (KQL)
