Detects the execution of the BCP utility in order to export data from the database. Attackers were seen saving their malware to a database column or table and then later extracting it via "bcp.exe" into a file.

Read More

Detects a copy command or a copy utility execution to or from an Admin share or remote

Read More

Identifies IPs performing DNS lookups associated with common Tor proxies.

Read More

DNSExfiltrator allows for transferring (exfiltrate) a file over a DNS request covert channel

Read More

Detects a suspicious output redirection to the local admins share, this technique is often found in malicious scripts or hacktool stagers

Read More

Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques

Read More

Detects the installation of a well-known TAP driver service. This could be a sign of potential preparation for data exfiltration using tunnelling techniques.

Read More

Well-known TAP software installation. Possible preparation for data exfiltration using tunneling techniques

Read More

Detects large DNS domain names

Read More

Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques

Read More