attack.t1567

Monero Crypto Coin Mining Pool Lookup

Nov 4, 2024 · attack.impact attack.t1496 attack.exfiltration attack.t1567 ·

Detects suspicious DNS queries to Monero mining pools

Arbitrary File Download Via ConfigSecurityPolicy.EXE

Aug 12, 2024 · attack.exfiltration attack.t1567 ·

Detects the execution of "ConfigSecurityPolicy.EXE", a binary part of Windows Defender used to manage settings in Windows Defender. Users can configure different pilot collections for each of the co-management workloads. It can be abused by attackers in order to upload or download files.

Communication To Ngrok Tunneling Service - Linux

Aug 12, 2024 · attack.exfiltration attack.command-and-control attack.t1567 attack.t1568.002 attack.t1572 attack.t1090 attack.t1102 attack.s0508 ·

Share on:

Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors

Communication To Ngrok Tunneling Service Initiated

Aug 12, 2024 · attack.exfiltration attack.command-and-control attack.t1567 attack.t1568.002 attack.t1572 attack.t1090 attack.t1102 attack.s0508 ·

Share on:

Detects an executable initiating a network connection to "ngrok" tunneling domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.

LOLBAS Data Exfiltration by DataSvcUtil.exe

Aug 12, 2024 · attack.exfiltration attack.t1567 ·

Share on:

Detects when a user performs data exfiltration by using DataSvcUtil.exe

Suspicious Curl File Upload - Linux

Aug 12, 2024 · attack.exfiltration attack.t1567 attack.t1105 ·

Share on:

Detects a suspicious curl process start the adds a file to a web request