attack.t1537

AWS EC2 VM Export Failure

Aug 12, 2024 · attack.collection attack.t1005 attack.exfiltration attack.t1537 ·

An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.

AWS S3 Data Management Tampering

Aug 12, 2024 · attack.exfiltration attack.t1537 ·

Share on:

Detects when a user tampers with S3 data management in Amazon Web Services.

AWS Snapshot Backup Exfiltration

Aug 12, 2024 · attack.exfiltration attack.t1537 ·

Share on:

Detects the modification of an EC2 snapshot's permissions to enable access from another account

Data Exfiltration to Unsanctioned Apps

Aug 12, 2024 · attack.exfiltration attack.t1537 ·

Share on:

Detects when a Microsoft Cloud App Security reported when a user or IP address uses an app that is not sanctioned to perform an activity that resembles an attempt to exfiltrate information from your organization.

Github Fork Private Repositories Setting Enabled/Cleared

Aug 12, 2024 · attack.persistence attack.t1020 attack.t1537 ·

Share on:

Detects when the policy allowing forks of private and internal repositories is changed (enabled or cleared).

Github Repository/Organization Transferred

Aug 12, 2024 · attack.persistence attack.t1020 attack.t1537 ·

Share on:

Detects when a repository or an organization is being transferred to another location.

Suspicious BlackCat-Related Exfiltration Command

Sep 1, 2023 · attack.exfiltration attack.t1020 attack.t1537 ·

Share on:

Detects process execution of RClone or similar tools used by ransomware operators to exfiltrate data.