Exfiltration Detections

Name Data Source Technique Type Analytic Story Date
Splunk Data exfiltration from Analytics Workspace using sid query Splunk Exfiltration Over Web Service Hunting Splunk Vulnerabilities 2024-12-17
ASL AWS EC2 Snapshot Shared Externally ASL AWS CloudTrail Transfer Data to Cloud Account TTP Data Exfiltration, Suspicious Cloud Instance Activities 2024-12-17
AWS AMI Attribute Modification for Exfiltration AWS CloudTrail ModifyImageAttribute Transfer Data to Cloud Account TTP Data Exfiltration, Suspicious Cloud Instance Activities 2024-11-14
AWS EC2 Snapshot Shared Externally AWS CloudTrail ModifySnapshotAttribute Transfer Data to Cloud Account TTP Data Exfiltration, Suspicious Cloud Instance Activities 2024-11-14
AWS Exfiltration via Bucket Replication AWS CloudTrail PutBucketReplication Transfer Data to Cloud Account TTP Data Exfiltration, Suspicious AWS S3 Activities 2024-11-14
AWS Exfiltration via EC2 Snapshot AWS CloudTrail CreateSnapshot, AWS CloudTrail DeleteSnapshot, AWS CloudTrail ModifySnapshotAttribute Transfer Data to Cloud Account TTP Data Exfiltration, Suspicious Cloud Instance Activities 2024-11-14
AWS S3 Exfiltration Behavior Identified Transfer Data to Cloud Account Correlation Data Exfiltration, Suspicious Cloud Instance Activities 2024-11-14
Gsuite Drive Share In External Email G Suite Drive Exfiltration to Cloud Storage Anomaly Dev Sec Ops, Insider Threat 2025-02-10
Gsuite Outbound Email With Attachment To External Domain G Suite Gmail Exfiltration Over Unencrypted Non-C2 Protocol Hunting Dev Sec Ops, Insider Threat 2025-02-10
O365 DLP Rule Triggered Exfiltration Over Alternative Protocol Exfiltration Over Web Service Anomaly Data Exfiltration 2024-11-14
O365 Email Access By Security Administrator Remote Email Collection Exfiltration Over Web Service TTP Azure Active Directory Account Takeover, Data Exfiltration, Office 365 Account Takeover 2025-02-10
O365 Exfiltration via File Access Exfiltration Over Web Service Data from Cloud Storage Anomaly Data Exfiltration, Office 365 Account Takeover 2024-10-14
O365 Exfiltration via File Download Exfiltration Over Web Service Data from Cloud Storage Anomaly Data Exfiltration, Office 365 Account Takeover 2024-10-14
O365 Exfiltration via File Sync Download Exfiltration Over Web Service Data from Cloud Storage Anomaly Data Exfiltration, Office 365 Account Takeover 2024-10-14
Clients Connecting to Multiple DNS Servers Exfiltration Over Unencrypted Non-C2 Protocol TTP Command And Control, DNS Hijacking, Host Redirection, Suspicious DNS Traffic 2024-11-14
Detect Long DNS TXT Record Response Exfiltration Over Unencrypted Non-C2 Protocol TTP Command And Control, Suspicious DNS Traffic 2024-11-14
Detection of DNS Tunnels Exfiltration Over Unencrypted Non-C2 Protocol TTP Command And Control, Data Protection, Suspicious DNS Traffic 2024-11-14
Detect RClone Command-Line Usage CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Automated Exfiltration TTP DarkSide Ransomware, Ransomware 2024-11-13
Detect Renamed RClone CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Automated Exfiltration Hunting DarkSide Ransomware, Ransomware 2024-11-13
DNS Exfiltration Using Nslookup App CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Exfiltration Over Alternative Protocol TTP Command And Control, Compromised Windows Host, Data Exfiltration, Dynamic DNS, Suspicious DNS Traffic 2024-12-10
Excessive Usage of NSLOOKUP App CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Exfiltration Over Alternative Protocol Anomaly Command And Control, Data Exfiltration, Dynamic DNS, Suspicious DNS Traffic 2024-11-13
High Frequency Copy Of Files In Network Share Windows Event Log Security 5145 Transfer Data to Cloud Account Anomaly Information Sabotage, Insider Threat 2024-11-13
Linux Auditd Data Transfer Size Limits Via Split Linux Auditd Execve Data Transfer Size Limits Anomaly Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation 2025-01-15
Linux Auditd Data Transfer Size Limits Via Split Syscall Linux Auditd Syscall Data Transfer Size Limits Anomaly Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation 2024-11-13
LOLBAS With Network Traffic Sysmon EventID 3 Ingress Tool Transfer Exfiltration Over Web Service System Binary Proxy Execution TTP Living Off The Land 2024-12-16
Potential Telegram API Request Via CommandLine CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Bidirectional Communication Exfiltration Over C2 Channel Anomaly XMRig 2025-02-19
Windows Exfiltration Over C2 Via Invoke RestMethod Powershell Script Block Logging 4104 Exfiltration Over C2 Channel TTP Winter Vivern 2024-11-13
Windows Exfiltration Over C2 Via Powershell UploadString Powershell Script Block Logging 4104 Exfiltration Over C2 Channel TTP Winter Vivern 2024-11-13
Windows Rundll32 WebDAV Request CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Exfiltration Over Unencrypted Non-C2 Protocol TTP CVE-2023-23397 Outlook Elevation of Privilege 2024-11-13
Windows Rundll32 WebDav With Network Connection Exfiltration Over Unencrypted Non-C2 Protocol TTP CVE-2023-23397 Outlook Elevation of Privilege 2024-11-13
Detect DNS Data Exfiltration using pretrained model in DSDL Exfiltration Over Unencrypted Non-C2 Protocol Anomaly Command And Control, DNS Hijacking, Suspicious DNS Traffic 2024-11-15
Detect SNICat SNI Exfiltration Exfiltration Over C2 Channel TTP Data Exfiltration 2024-11-15
Detect Traffic Mirroring Traffic Duplication Hardware Additions Network Denial of Service TTP Router and Infrastructure Security 2025-02-10
DNS Query Length With High Standard Deviation Sysmon EventID 22 Exfiltration Over Unencrypted Non-C2 Protocol Anomaly Command And Control, Hidden Cobra Malware, Suspicious DNS Traffic 2025-02-10
Prohibited Network Traffic Allowed Exfiltration Over Alternative Protocol TTP Command And Control, Prohibited Traffic Allowed or Protocol Mismatch, Ransomware 2024-11-15
Protocol or Port Mismatch Exfiltration Over Unencrypted Non-C2 Protocol Anomaly Command And Control, Prohibited Traffic Allowed or Protocol Mismatch 2025-02-10
High Volume of Bytes Out to Url Nginx Access Exfiltration Over Web Service Anomaly Data Exfiltration 2024-11-15
Multiple Archive Files Http Post Traffic Splunk Stream HTTP Exfiltration Over Unencrypted Non-C2 Protocol TTP Command And Control, Data Exfiltration 2025-02-10
Plain HTTP POST Exfiltrated Data Splunk Stream HTTP Exfiltration Over Unencrypted Non-C2 Protocol TTP Command And Control, Data Exfiltration 2025-02-10