attack.exfiltration

Exports Critical Registry Keys To a File

Apr 25, 2025 · attack.exfiltration attack.discovery attack.t1012 ·

Share on:

Detects the export of a crital Registry key to a file.

Exports Registry Key To a File

Apr 25, 2025 · attack.exfiltration attack.discovery attack.t1012 ·

Share on:

Detects the export of the target Registry key to a file.

Network Communication Initiated To Portmap.IO Domain

Apr 16, 2025 · attack.t1041 attack.command-and-control attack.t1090.002 attack.exfiltration ·

Share on:

Detects an executable accessing the portmap.io domain, which could be a sign of forbidden C2 traffic or data exfiltration by malicious actors

Network Connection Initiated To Cloudflared Tunnels Domains

Apr 16, 2025 · attack.exfiltration attack.command-and-control attack.t1567.001 ·

Share on:

Detects network connections to Cloudflared tunnels domains initiated by a process on the system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Potential CVE-2023-23397 Exploitation Attempt - SMB

Apr 10, 2025 · attack.exfiltration cve.2023-23397 detection.emerging-threats ·

Share on:

Detects (failed) outbound connection attempts to internet facing SMB servers. This could be a sign of potential exploitation attempts of CVE-2023-23397.

OpenCanary - FTP Login Attempt

Feb 3, 2025 · attack.initial-access attack.exfiltration attack.t1190 attack.t1021 ·

Share on:

Detects instances where an FTP service on an OpenCanary node has had a login attempt.

OpenCanary - TFTP Request

Feb 3, 2025 · attack.exfiltration attack.t1041 ·

Share on:

Detects instances where a TFTP service on an OpenCanary node has had a request.

Modification or Deletion of an AWS RDS Cluster

Dec 6, 2024 · attack.exfiltration attack.t1020 ·

Share on:

Detects modifications to an RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauthorized access, or exposure of sensitive information.

Monero Crypto Coin Mining Pool Lookup

Nov 4, 2024 · attack.impact attack.t1496 attack.exfiltration attack.t1567 ·

Share on:

Detects suspicious DNS queries to Monero mining pools

Compressed File Creation Via Tar.EXE

Nov 1, 2024 · attack.collection attack.exfiltration attack.t1560 attack.t1560.001 ·

Share on:

Detects execution of "tar.exe" in order to create a compressed file. Adversaries may abuse various utilities to compress or encrypt data before exfiltration.

Compressed File Extraction Via Tar.EXE

Nov 1, 2024 · attack.collection attack.exfiltration attack.t1560 attack.t1560.001 ·

Share on:

Detects execution of "tar.exe" in order to extract compressed file. Adversaries may abuse various utilities in order to decompress data to avoid detection.

Network Connection Initiated To DevTunnels Domain

Oct 1, 2024 · attack.exfiltration attack.t1567.001 ·

Share on:

Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Network Connection Initiated To Visual Studio Code Tunnels Domain

Oct 1, 2024 · attack.exfiltration attack.t1567.001 ·

Share on:

Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Network Connection Initiated To BTunnels Domains

Sep 13, 2024 · attack.exfiltration attack.t1567.001 ·

Share on:

Detects network connections to BTunnels domains initiated by a process on the system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Active Directory Structure Export Via Csvde.EXE

Aug 12, 2024 · attack.exfiltration attack.discovery attack.t1087.002 ·

Share on:

Detects the execution of "csvde.exe" in order to export organizational Active Directory structure.

Active Directory Structure Export Via Ldifde.EXE

Aug 12, 2024 · attack.exfiltration ·

Share on:

Detects the execution of "ldifde.exe" in order to export organizational Active Directory structure.

APT40 Dropbox Tool User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.exfiltration attack.t1567.002 ·

Share on:

Detects suspicious user agent string of APT40 Dropbox tool

Arbitrary File Download Via ConfigSecurityPolicy.EXE

Aug 12, 2024 · attack.exfiltration attack.t1567 ·

Share on:

Detects the execution of "ConfigSecurityPolicy.EXE", a binary part of Windows Defender used to manage settings in Windows Defender. Users can configure different pilot collections for each of the co-management workloads. It can be abused by attackers in order to upload or download files.

AWS EC2 VM Export Failure

Aug 12, 2024 · attack.collection attack.t1005 attack.exfiltration attack.t1537 ·

Share on:

An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.

AWS RDS Master Password Change

Aug 12, 2024 · attack.exfiltration attack.t1020 ·

Share on:

Detects the change of database master password. It may be a part of data exfiltration.

AWS S3 Data Management Tampering

Aug 12, 2024 · attack.exfiltration attack.t1537 ·

Share on:

Detects when a user tampers with S3 data management in Amazon Web Services.

AWS Snapshot Backup Exfiltration

Aug 12, 2024 · attack.exfiltration attack.t1537 ·

Share on:

Detects the modification of an EC2 snapshot's permissions to enable access from another account

Cisco Stage Data

Aug 12, 2024 · attack.collection attack.lateral-movement attack.command-and-control attack.exfiltration attack.t1074 attack.t1105 attack.t1560.001 ·

Share on:

Various protocols maybe used to put data on the device for exfil or infil

Communication To Ngrok Tunneling Service - Linux

Aug 12, 2024 · attack.exfiltration attack.command-and-control attack.t1567 attack.t1568.002 attack.t1572 attack.t1090 attack.t1102 attack.s0508 ·

Share on:

Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors

Communication To Ngrok Tunneling Service Initiated

Aug 12, 2024 · attack.exfiltration attack.command-and-control attack.t1567 attack.t1568.002 attack.t1572 attack.t1090 attack.t1102 attack.s0508 ·

Share on:

Detects an executable initiating a network connection to "ngrok" tunneling domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.

Copy From Or To Admin Share Or Sysvol Folder

Aug 12, 2024 · attack.lateral-movement attack.collection attack.exfiltration attack.t1039 attack.t1048 attack.t1021.002 ·

Share on:

Detects a copy command or a copy utility execution to or from an Admin share or remote

Data Compressed

Aug 12, 2024 · attack.exfiltration attack.t1560.001 ·

Share on:

An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

Data Exfiltration to Unsanctioned Apps

Aug 12, 2024 · attack.exfiltration attack.t1537 ·

Share on:

Detects when a Microsoft Cloud App Security reported when a user or IP address uses an app that is not sanctioned to perform an activity that resembles an attempt to exfiltrate information from your organization.

Data Exfiltration with Wget

Aug 12, 2024 · attack.exfiltration attack.t1048.003 ·

Share on:

Detects attempts to post the file with the usage of wget utility. The adversary can bypass the permission restriction with the misconfigured sudo permission for wget utility which could allow them to read files like /etc/shadow.

Disk Image Creation Via Hdiutil - MacOS

Aug 12, 2024 · attack.exfiltration ·

Share on:

Detects the execution of the hdiutil utility in order to create a disk image.

DNS Exfiltration and Tunneling Tools Execution

Aug 12, 2024 · attack.exfiltration attack.t1048.001 attack.command-and-control attack.t1071.004 attack.t1132.001 ·

Share on:

Well-known DNS Exfiltration tools execution

DNS Query for Anonfiles.com Domain - DNS Client

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·

Share on:

Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes

DNS Query for Anonfiles.com Domain - Sysmon

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·

Share on:

Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes

DNS Query To MEGA Hosting Website

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·

Share on:

Detects DNS queries for subdomains related to MEGA sharing website

DNS Query To MEGA Hosting Website - DNS Client

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·

Share on:

Detects DNS queries for subdomains related to MEGA sharing website

DNS Query To Ufile.io

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·

Share on:

Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration

DNS Query To Ufile.io - DNS Client

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·

Share on:

Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration

DNS TOR Proxies

Aug 12, 2024 · attack.exfiltration attack.t1048 ·

Share on:

Identifies IPs performing DNS lookups associated with common Tor proxies.

Email Exifiltration Via Powershell

Aug 12, 2024 · attack.exfiltration ·

Share on:

Detects email exfiltration via powershell cmdlets

LOLBAS Data Exfiltration by DataSvcUtil.exe

Aug 12, 2024 · attack.exfiltration attack.t1567 ·

Share on:

Detects when a user performs data exfiltration by using DataSvcUtil.exe

Network Connection Initiated To Mega.nz

Aug 12, 2024 · attack.exfiltration attack.t1567.001 ·

Share on:

Detects a network connection initiated by a binary to "api.mega.co.nz". Attackers were seen abusing file sharing websites similar to "mega.nz" in order to upload/download additional payloads.

Potential Data Exfiltration Via Audio File

Aug 12, 2024 · attack.exfiltration ·

Share on:

Detects potential exfiltration attempt via audio file using PowerShell

Powershell DNSExfiltration

Aug 12, 2024 · attack.exfiltration attack.t1048 ·

Share on:

DNSExfiltrator allows for transferring (exfiltrate) a file over a DNS request covert channel

PowerShell ICMP Exfiltration

Aug 12, 2024 · attack.exfiltration attack.t1048.003 ·

Share on:

Detects Exfiltration Over Alternative Protocol - ICMP. Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.

PowerShell Script With File Hostname Resolving Capabilities

Aug 12, 2024 · attack.exfiltration attack.t1020 ·

Share on:

Detects PowerShell scripts that have capabilities to read files, loop through them and resolve DNS host entries.

PowerShell Script With File Upload Capabilities

Aug 12, 2024 · attack.exfiltration attack.t1020 ·

Share on:

Detects PowerShell scripts leveraging the "Invoke-WebRequest" cmdlet to send data via either "PUT" or "POST" method.

Process Initiated Network Connection To Ngrok Domain

Aug 12, 2024 · attack.exfiltration attack.t1567.001 ·

Share on:

Detects an executable initiating a network connection to "ngrok" domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.

PUA - Rclone Execution

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·

Share on:

Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc

Rclone Activity via Proxy

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·

Share on:

Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string

Rclone Config File Creation

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·

Share on:

Detects Rclone config files being created

Restore Public AWS RDS Instance

Aug 12, 2024 · attack.exfiltration attack.t1020 ·

Share on:

Detects the recovery of a new public database instance from a snapshot. It may be a part of data exfiltration.

Split A File Into Pieces

Aug 12, 2024 · attack.exfiltration attack.t1030 ·

Share on:

Detection use of the command "split" to split files into parts and possible transfer.

Split A File Into Pieces - Linux

Aug 12, 2024 · attack.exfiltration attack.t1030 ·

Share on:

Detection use of the command "split" to split files into parts and possible transfer.

Suspicious Curl File Upload - Linux

Aug 12, 2024 · attack.exfiltration attack.t1567 attack.t1105 ·

Share on:

Detects a suspicious curl process start the adds a file to a web request

Suspicious DNS Query with B64 Encoded String

Aug 12, 2024 · attack.exfiltration attack.t1048.003 attack.command-and-control attack.t1071.004 ·

Share on:

Detects suspicious DNS queries using base64 encoding

Suspicious Inbox Forwarding

Aug 12, 2024 · attack.exfiltration attack.t1020 ·

Share on:

Detects when a Microsoft Cloud App Security reported suspicious email forwarding rules, for example, if a user created an inbox rule that forwards a copy of all emails to an external address.

Suspicious OAuth App File Download Activities

Aug 12, 2024 · attack.exfiltration ·

Share on:

Detects when a Microsoft Cloud App Security reported when an app downloads multiple files from Microsoft SharePoint or Microsoft OneDrive in a manner that is unusual for the user.

Suspicious Outbound SMTP Connections

Aug 12, 2024 · attack.exfiltration attack.t1048.003 ·

Share on:

Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.

Suspicious PowerShell Mailbox Export to Share

Aug 12, 2024 · attack.exfiltration ·

Share on:

Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations

Suspicious PowerShell Mailbox Export to Share - PS

Aug 12, 2024 · attack.exfiltration ·

Share on:

Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations

Suspicious PowerShell Mailbox SMTP Forward Rule

Aug 12, 2024 · attack.exfiltration ·

Share on:

Detects usage of the powerShell Set-Mailbox Cmdlet to set-up an SMTP forwarding rule.

Suspicious Redirection to Local Admin Share

Aug 12, 2024 · attack.exfiltration attack.t1048 ·

Share on:

Detects a suspicious output redirection to the local admins share, this technique is often found in malicious scripts or hacktool stagers

Suspicious SQL Query

Aug 12, 2024 · attack.exfiltration attack.initial-access attack.privilege-escalation attack.t1190 attack.t1505.001 ·

Share on:

Detects suspicious SQL query keywrods that are often used during recon, exfiltration or destructive activities. Such as dropping tables and selecting wildcard fields

Suspicious WebDav Client Execution Via Rundll32.EXE

Aug 12, 2024 · attack.exfiltration attack.t1048.003 cve.2023-23397 ·

Share on:

Detects "svchost.exe" spawning "rundll32.exe" with command arguments like C:\windows\system32\davclnt.dll,DavSetCookie. This could be an indicator of exfiltration or use of WebDav to launch code (hosted on WebDav Server) or potentially a sign of exploitation of CVE-2023-23397

Suspicious Windows Strings In URI

Aug 12, 2024 · attack.persistence attack.exfiltration attack.t1505.003 ·

Share on:

Detects suspicious Windows strings in URI which could indicate possible exfiltration or webshell communication

Tap Driver Installation

Aug 12, 2024 · attack.exfiltration attack.t1048 ·

Share on:

Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques

Tap Driver Installation - Security

Aug 12, 2024 · attack.exfiltration attack.t1048 ·

Share on:

Detects the installation of a well-known TAP driver service. This could be a sign of potential preparation for data exfiltration using tunnelling techniques.

Tap Installer Execution

Aug 12, 2024 · attack.exfiltration attack.t1048 ·

Share on:

Well-known TAP software installation. Possible preparation for data exfiltration using tunneling techniques

WebDav Client Execution Via Rundll32.EXE

Aug 12, 2024 · attack.exfiltration attack.t1048.003 ·

Share on:

Detects "svchost.exe" spawning "rundll32.exe" with command arguments like "C:\windows\system32\davclnt.dll,DavSetCookie". This could be an indicator of exfiltration or use of WebDav to launch code (hosted on a WebDav server).

WebDav Put Request

Aug 12, 2024 · attack.exfiltration attack.t1048.003 ·

Share on:

A General detection for WebDav user-agent being used to PUT files on a WebDav network share. This could be an indicator of exfiltration.

Rclone SMB Share Exfiltration

Aug 2, 2024 · attack.exfiltration attack.t1567.002 ·

Share on:

Detection of a exfiltration activity using rclone from Windows network shares using SMB.

DNS Query for Ufile.io Upload Domain

Feb 23, 2024 · attack.exfiltration attack.t1567.002 ·

Share on:

Detects DNS queries for subdomains used for upload to ufile.io

Suspicious BlackCat-Related Exfiltration Command

Sep 1, 2023 · attack.exfiltration attack.t1020 attack.t1537 ·

Share on:

Detects process execution of RClone or similar tools used by ransomware operators to exfiltrate data.

AWS EC2 Download Userdata

Apr 21, 2023 · attack.exfiltration attack.t1020 ·

Share on:

Detects bulk downloading of User Data associated with AWS EC2 instances. Instance User Data may include installation scripts and hard-coded secrets for deployment.

High DNS Bytes Out

Apr 21, 2023 · attack.exfiltration attack.t1048.003 ·

Share on:

High DNS queries bytes amount from host per short period of time

High DNS Bytes Out - Firewall

Apr 21, 2023 · attack.exfiltration attack.t1048.003 ·

Share on:

High DNS queries bytes amount from host per short period of time

High DNS Requests Rate

Apr 21, 2023 · attack.exfiltration attack.t1048.003 attack.command_and_control attack.t1071.004 ·

Share on:

High DNS requests amount from host per short period of time

High DNS Requests Rate - Firewall

Apr 21, 2023 · attack.exfiltration attack.t1048.003 attack.command_and_control attack.t1071.004 ·

Share on:

High DNS requests amount from host per short period of time

High NULL Records Requests Rate

Apr 21, 2023 · attack.exfiltration attack.t1048.003 attack.command_and_control attack.t1071.004 ·

Share on:

Extremely high rate of NULL record type DNS requests from host per short period of time. Possible result of iodine tool execution

High TXT Records Requests Rate

Apr 21, 2023 · attack.exfiltration attack.t1048.003 attack.command_and_control attack.t1071.004 ·

Share on:

Extremely high rate of TXT record type DNS requests from host per short period of time. Possible result of Do-exfiltration tool execution

Large domain name request

Apr 21, 2023 · attack.exfiltration attack.t1048 ·

Share on:

Detects large DNS domain names

Possible DNS Tunneling

Apr 21, 2023 · attack.command_and_control attack.t1071.004 attack.exfiltration attack.t1048.003 ·

Share on:

Normally, DNS logs contain a limited amount of different dns queries for a single domain. This rule detects a high amount of queries for a single domain, which can be an indicator that DNS is used to transfer data.

Potential Exfiltration of Compressed Files

Apr 21, 2023 · attack.exfiltration attack.t1560.001 attack.t1005 ·

Share on:

This rule detects potential exfiltration by looking for a few compression extensions in the uri and signs of compression in the mime type, file type, and http body

Tap Driver Installation

Apr 21, 2023 · attack.exfiltration attack.t1048 ·

Share on:

Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques