| elastic |
Potential Data Exfiltration Through Wget |
production |
2026-10-09 |
| splunk |
Ollama Possible Model Exfiltration Data Leakage |
deprecated |
2026-10-09 |
| elastic |
Potential Data Exfiltration Through Curl |
production |
2026-10-06 |
| elastic |
LLM-Based Curl Activity Triage via Auditd |
production |
2026-09-25 |
| elastic |
LLM-Based Curl Activity Triage |
production |
2026-09-25 |
| elastic |
LLM-Based Wget Activity Triage |
production |
2026-09-25 |
| elastic |
LLM-Based Wget Activity Triage via Auditd |
production |
2026-09-25 |
| splunk |
Prohibited Network Traffic Allowed |
production |
2026-09-22 |
| elastic |
Potential DNS Tunneling via NULL or Long DNS Queries |
production |
2026-09-21 |
| elastic |
SMB (Windows File Sharing) Activity to the Internet |
production |
2026-09-21 |
| elastic |
Network Traffic to Rare Destination Country |
production |
2026-09-18 |
| elastic |
Netcat File Transfer or Listener Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Network Activity Detected via cat |
production |
2026-09-18 |
| elastic |
File Transfer or Listener Established via Netcat |
production |
2026-09-18 |
| elastic |
Potential Database Dumping Activity |
production |
2026-09-18 |
| elastic |
File Transfer Utility Launched from Unusual Parent |
production |
2026-09-18 |
| elastic |
Unusual DNS Activity |
production |
2026-09-18 |
| elastic |
Spike in host-based traffic |
production |
2026-09-18 |
| elastic |
Spike in Network Traffic To a Country |
production |
2026-09-18 |
| elastic |
Unusual Windows Network Activity |
production |
2026-09-18 |
| elastic |
SMTP to the Internet on Port 26/TCP |
production |
2026-09-18 |
| elastic |
Windows Registry File Creation in SMB Share |
production |
2026-09-18 |
| elastic |
Potential DNS Exfiltration via Excessive Chunked Queries |
production |
2026-09-18 |
| elastic |
Potential Data Exfiltration via Rclone |
production |
2026-09-18 |
| elastic |
Rare SMB Connection to the Internet |
production |
2026-09-18 |
| splunk |
Excessive Usage of NSLOOKUP App |
production |
2026-08-24 |
| splunk |
O365 DLP Rule Triggered |
production |
2026-05-13 |
| splunk |
DNS Exfiltration Using Nslookup App |
production |
2026-05-13 |
| sigma |
TanStack Supply-Chain Attack DNS Indicators |
experimental |
2026-05-12 |
| sigma |
Copy From Or To Admin Share Or Sysvol Folder |
test |
2025-10-22 |
| sigma |
PUA - Restic Backup Tool Execution |
experimental |
2025-10-17 |
| sigma |
FTP Connection Open Attempt Via Winscp CLI |
experimental |
2025-10-12 |
| sigma |
Winscp Execution From Non Standard Folder |
experimental |
2025-10-12 |
| sigma |
DNS TOR Proxies |
test |
2025-09-12 |
| sigma |
Data Export From MSSQL Table Via BCP.EXE |
test |
2024-08-20 |
| sigma |
Suspicious Redirection to Local Admin Share |
test |
2023-12-28 |
| sigma |
Tap Installer Execution |
test |
2023-12-11 |
| sigma |
Tap Driver Installation |
test |
2022-12-25 |
| sigma |
Tap Driver Installation - Security |
test |
2022-11-29 |
| sigma |
Powershell DNSExfiltration |
test |
2022-01-07 |
| elastic |
IRC (Internet Relay Chat) Protocol Activity to the Internet |
deprecated |
2021-04-15 |
| elastic |
SMTP to the Internet |
deprecated |
2021-04-15 |
| elastic |
RDP (Remote Desktop Protocol) to the Internet |
deprecated |
2021-04-15 |
| elastic |
FTP (File Transfer Protocol) Activity to the Internet |
deprecated |
2021-04-15 |
| sentinel |
DNS events related to ToR proxies (ASIM DNS Schema) |
Scheduled |
— |