attack.t1567 | Detection.FYI

Suspicious Curl File Upload - Linux
May 3, 2023 · attack.exfiltration attack.t1567 attack.t1105 ·
Share on:
Detects a suspicious curl process start the adds a file to a web request

Read More
Communication To Ngrok Tunneling Service
Feb 1, 2023 · attack.exfiltration attack.command_and_control attack.t1567 attack.t1568.002 attack.t1572 attack.t1090 attack.t1102 attack.s0508 ·
Share on:
Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors

Read More
Communication To Ngrok Tunneling Service - Linux
Feb 1, 2023 · attack.exfiltration attack.command_and_control attack.t1567 attack.t1568.002 attack.t1572 attack.t1090 attack.t1102 attack.s0508 ·
Share on:
Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors

Read More
Monero Crypto Coin Mining Pool Lookup
Feb 1, 2023 · attack.impact attack.t1496 attack.t1567 ·
Share on:
Detects suspicious DNS queries to Monero mining pools

Read More
LOLBAS Data Exfiltration by DataSvcUtil.exe
Oct 28, 2022 · attack.exfiltration attack.t1567 ·
Share on:
Detects when a user performs data exfiltration by using DataSvcUtil.exe

Read More
Suspicious ConfigSecurityPolicy Execution
Oct 28, 2022 · attack.exfiltration attack.t1567 ·
Share on:
Upload file, credentials or data exfiltration with Binary part of Windows Defender

Read More