| elastic |
Connection to Commonly Abused Web Services |
production |
2026-10-19 |
| elastic |
OpenAI ChatGPT Enterprise High File Download Activity |
production |
2026-10-09 |
| elastic |
OpenAI ChatGPT Enterprise Google Drive Download Burst |
production |
2026-10-09 |
| elastic |
OpenAI ChatGPT Enterprise Gmail Message Sent via Connector |
production |
2026-10-09 |
| elastic |
OpenAI ChatGPT Enterprise Resources Sharing Updated |
production |
2026-10-06 |
| elastic |
OpenAI ChatGPT Enterprise Conversation Shared |
production |
2026-10-06 |
| elastic |
AWS S3 Bucket Replicated to Another Account |
production |
2026-10-06 |
| elastic |
Anthropic Organization Data Export Accessed |
production |
2026-09-25 |
| elastic |
Anthropic High File Upload Activity |
production |
2026-09-25 |
| elastic |
Anthropic Excessive Chat Snapshot Creation |
production |
2026-09-25 |
| elastic |
Anthropic Artifact Shared Publicly |
production |
2026-09-25 |
| elastic |
Network Connection to OAST Domain via Script Interpreter |
production |
2026-09-23 |
| elastic |
Several Failed Protected Branch Force Pushes by User |
production |
2026-09-18 |
| elastic |
AWS DynamoDB Scan by Unusual User |
production |
2026-09-18 |
| elastic |
AWS DynamoDB Table Exported to S3 |
production |
2026-09-18 |
| elastic |
AWS EC2 Export Task |
production |
2026-09-18 |
| elastic |
AWS RDS Snapshot Export |
production |
2026-09-18 |
| elastic |
AWS API Activity from Uncommon S3 Client by Rare User |
production |
2026-09-18 |
| elastic |
AWS SNS Rare Protocol Subscription by User |
production |
2026-09-18 |
| elastic |
AWS SNS Topic Message Publish by Rare User |
production |
2026-09-18 |
| elastic |
Azure Storage Blob Retrieval via AzCopy |
production |
2026-09-18 |
| elastic |
GitHub Private Repository Turned Public |
production |
2026-09-18 |
| elastic |
GitHub Exfiltration via High Number of Repository Clones by User |
production |
2026-09-18 |
| elastic |
High Number of Closed Pull Requests by User |
production |
2026-09-18 |
| elastic |
High Number of Protected Branch Force Pushes by User |
production |
2026-09-18 |
| elastic |
M365 OneDrive/SharePoint Excessive File Downloads |
production |
2026-09-18 |
| elastic |
Unusual DNS Request to Suspicious Top Level Domain |
production |
2026-09-18 |
| elastic |
Suspicious AWS S3 Connection via Script Interpreter |
production |
2026-09-18 |
| elastic |
Unusual Network Connection to Suspicious Web Service |
production |
2026-09-18 |
| elastic |
Potential File Transfer via Certreq |
production |
2026-09-18 |
| elastic |
Potential File Transfer via Curl for Windows |
production |
2026-09-18 |
| elastic |
Potential PowerShell HackTool Script by Function Names |
production |
2026-09-18 |
| elastic |
AzCopy or Azure Storage Explorer Usage on Unusual Host |
production |
2026-09-18 |
| elastic |
Potential Data Exfiltration via Rclone |
production |
2026-09-18 |
| elastic |
Potential Third-Party Cloud Storage Client Execution |
production |
2026-09-14 |
| splunk |
LOLBAS Rare Network Connection |
production |
2026-08-24 |
| splunk |
LOLBAS Network Connection On Uncommon Port |
production |
2026-08-24 |
| splunk |
O365 DLP Rule Triggered |
production |
2026-05-13 |
| splunk |
Linux Gdrive Binary Activity |
production |
2026-05-13 |
| splunk |
Windows Gdrive Binary Activity |
production |
2026-05-13 |
| splunk |
Cisco TFTP Server Configuration for Data Exfiltration |
production |
2026-05-13 |
| splunk |
O365 Exfiltration via File Access |
production |
2026-05-13 |
| splunk |
O365 Exfiltration via File Download |
production |
2026-05-13 |
| splunk |
O365 Exfiltration via File Sync Download |
production |
2026-05-13 |
| splunk |
High Volume of Bytes Out to Url |
production |
2026-05-13 |
| splunk |
O365 Email Access By Security Administrator |
production |
2026-05-13 |
| sigma |
Process Initiated Network Connection To Ngrok Domain |
test |
2025-07-30 |
| snort |
ET TROJAN Specter Insight Beacon CnC Checkin M1 |
rev 2 |
2025-04-14 |
| suricata |
ET MALWARE Specter Insight Beacon CnC Checkin M1 |
rev 2 |
2025-04-14 |
| suricata |
ET MALWARE SvcStealer CNC Tasking Checkin |
rev 1 |
2025-03-21 |
| snort |
ET TROJAN SvcStealer Data Exfiltration Attempt |
rev 1 |
2025-03-21 |
| snort |
ET TROJAN SvcStealer CNC Tasking Checkin |
rev 1 |
2025-03-21 |
| suricata |
ET MALWARE SvcStealer Data Exfiltration Attempt |
rev 1 |
2025-03-21 |
| snort |
ET TROJAN OtterCookie File Exfiltration M1 |
rev 1 |
2025-03-05 |
| suricata |
ET MALWARE OtterCookie File Exfiltration M1 |
rev 1 |
2025-03-05 |
| sigma |
Network Connection Initiated To BTunnels Domains |
test |
2024-09-13 |
| sigma |
Network Connection Initiated To Cloudflared Tunnels Domains |
test |
2024-05-27 |
| sigma |
Communication To Ngrok Tunneling Service Initiated |
test |
2024-02-02 |
| sigma |
Network Connection Initiated To Visual Studio Code Tunnels Domain |
test |
2023-11-20 |
| sigma |
Suspicious Non-Browser Network Communication With Telegram API |
test |
2023-05-19 |
| sigma |
Potential Data Exfiltration Via Curl.EXE |
test |
2023-05-02 |
| sigma |
Suspicious Curl File Upload - Linux |
test |
2023-05-02 |
| sigma |
Communication To Ngrok Tunneling Service - Linux |
test |
2022-11-03 |
| sigma |
LOLBAS Data Exfiltration by DataSvcUtil.exe |
test |
2022-05-16 |
| sigma |
Arbitrary File Download Via ConfigSecurityPolicy.EXE |
test |
2022-05-16 |
| sigma |
Monero Crypto Coin Mining Pool Lookup |
stable |
2021-10-24 |