| elastic |
Potential Data Exfiltration Through Curl |
production |
2026-10-06 |
| elastic |
Potential DNS Tunneling via NULL or Long DNS Queries |
production |
2026-09-21 |
| elastic |
File Transfer or Listener Established via Netcat |
production |
2026-09-18 |
| elastic |
Netcat File Transfer or Listener Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Potential DNS Exfiltration via Excessive Chunked Queries |
production |
2026-09-18 |
| splunk |
Plain HTTP POST Exfiltrated Data |
production |
2026-09-08 |
| splunk |
Linux Shell Pseudo Device Reverse Shell |
production |
2026-07-08 |
| splunk |
Windows Rundll32 WebDAV Request |
production |
2026-05-13 |
| splunk |
Cisco ASA - Device File Copy to Remote Location |
production |
2026-05-13 |
| splunk |
Gsuite Outbound Email With Attachment To External Domain |
production |
2026-05-13 |
| splunk |
Windows Rundll32 WebDav With Network Connection |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Potential Data Exfiltration |
production |
2026-05-13 |
| splunk |
DNS Query Length With High Standard Deviation |
production |
2026-05-13 |
| splunk |
Protocol or Port Mismatch |
production |
2026-05-13 |
| splunk |
Multiple Archive Files Http Post Traffic |
production |
2026-05-13 |
| sigma |
Python WebServer Execution - Linux |
experimental |
2025-10-17 |
| sigma |
Potential Data Exfiltration Over SMTP Via Send-MailMessage Cmdlet |
test |
2024-11-01 |
| sigma |
WebDav Put Request |
test |
2024-03-13 |
| sigma |
WebDav Client Execution Via Rundll32.EXE |
test |
2023-09-18 |
| sigma |
Suspicious WebDav Client Execution Via Rundll32.EXE |
test |
2023-09-18 |
| sigma |
Data Exfiltration with Wget |
test |
2022-12-25 |
| sigma |
PowerShell ICMP Exfiltration |
test |
2022-12-25 |
| sigma |
Suspicious DNS Query with B64 Encoded String |
test |
2022-10-09 |
| sigma |
Suspicious Outbound SMTP Connections |
test |
2022-09-21 |