attack.t1048

TanStack Supply-Chain Attack DNS Indicators

Jul 9, 2026 · attack.command-and-control attack.t1071.001 attack.exfiltration attack.t1048 detection.emerging-threats ·

Detects DNS queries to attacker-controlled infrastructure used by the Mini Shai-Hulud campaign targeting TanStack npm packages along with other packages such as mistralai, uipath and so on. The domain git-tanstack.com (registered May 9, 2026) hosted secondary payloads including transformers.pyz. The filev2.getsession.org endpoint was used for credential exfiltration via the Session protocol.

DNS TOR Proxies

Nov 24, 2025 · attack.exfiltration attack.t1048 ·

Share on:

Identifies IPs performing DNS lookups associated with common Tor proxies.

Copy From Or To Admin Share Or Sysvol Folder

Nov 10, 2025 · attack.lateral-movement attack.collection attack.exfiltration attack.t1039 attack.t1048 attack.t1021.002 ·

Share on:

Detects a copy command or a copy utility execution to or from an Admin share or remote

PUA - Restic Backup Tool Execution

Oct 24, 2025 · attack.exfiltration attack.t1048 attack.t1567.002 ·

Share on:

Detects the execution of the Restic backup tool, which can be used for data exfiltration. Threat actors may leverage Restic to back up and exfiltrate sensitive data to remote storage locations, including cloud services. If not legitimately used in the enterprise environment, its presence may indicate malicious activity.

Data Export From MSSQL Table Via BCP.EXE

Jul 1, 2025 · attack.execution attack.exfiltration attack.t1048 ·

Share on:

Detects the execution of the BCP utility in order to export data from the database. Attackers were seen saving their malware to a database column or table and then later extracting it via "bcp.exe" into a file.

Powershell DNSExfiltration

Aug 12, 2024 · attack.exfiltration attack.t1048 ·

Share on:

DNSExfiltrator allows for transferring (exfiltrate) a file over a DNS request covert channel

Suspicious Redirection to Local Admin Share

Aug 12, 2024 · attack.exfiltration attack.t1048 ·

Share on:

Detects a suspicious output redirection to the local admins share, this technique is often found in malicious scripts or hacktool stagers

Tap Driver Installation

Aug 12, 2024 · attack.exfiltration attack.t1048 ·

Share on:

Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques

Tap Driver Installation - Security

Aug 12, 2024 · attack.exfiltration attack.t1048 ·

Share on:

Detects the installation of a well-known TAP driver service. This could be a sign of potential preparation for data exfiltration using tunnelling techniques.

Tap Installer Execution

Aug 12, 2024 · attack.exfiltration attack.t1048 ·

Share on:

Well-known TAP software installation. Possible preparation for data exfiltration using tunneling techniques

Large domain name request

Apr 21, 2023 · attack.exfiltration attack.t1048 ·

Share on:

Detects large DNS domain names

Tap Driver Installation

Apr 21, 2023 · attack.exfiltration attack.t1048 ·

Share on:

Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques