| elastic |
Connection to Commonly Abused Web Services |
production |
2026-10-19 |
| splunk |
Cisco Secure Firewall - Connection to File Sharing Domain |
production |
2026-10-08 |
| elastic |
AWS S3 Bucket Replicated to Another Account |
production |
2026-10-06 |
| splunk |
Cisco NVM - Rclone Execution With Network Activity |
production |
2026-09-22 |
| elastic |
Potential PowerShell HackTool Script by Function Names |
production |
2026-09-18 |
| elastic |
Unusual Network Connection to Suspicious Web Service |
production |
2026-09-18 |
| elastic |
Suspicious AWS S3 Connection via Script Interpreter |
production |
2026-09-18 |
| elastic |
Unusual DNS Request to Suspicious Top Level Domain |
production |
2026-09-18 |
| elastic |
AzCopy or Azure Storage Explorer Usage on Unusual Host |
production |
2026-09-18 |
| elastic |
Azure Storage Blob Retrieval via AzCopy |
production |
2026-09-18 |
| elastic |
AWS API Activity from Uncommon S3 Client by Rare User |
production |
2026-09-18 |
| elastic |
AWS RDS Snapshot Export |
production |
2026-09-18 |
| elastic |
AWS EC2 Export Task |
production |
2026-09-18 |
| elastic |
AWS DynamoDB Table Exported to S3 |
production |
2026-09-18 |
| elastic |
Potential Data Exfiltration via Rclone |
production |
2026-09-18 |
| elastic |
Potential Third-Party Cloud Storage Client Execution |
production |
2026-09-14 |
| splunk |
Cisco Secure Firewall - Potential Data Exfiltration |
production |
2026-05-13 |
| splunk |
Windows Azure Storage Utility Execution Via CLI |
production |
2026-05-13 |
| splunk |
Gsuite Drive Share In External Email |
experimental |
2026-05-13 |
| splunk |
Windows OneDrive Share Mounted via Net |
production |
2026-05-13 |
| sigma |
Curl File Upload To File Sharing Websites |
experimental |
2026-03-29 |
| sigma |
PUA - Restic Backup Tool Execution |
experimental |
2025-10-17 |
| sigma |
Network Connection Initiated To Mega.nz |
test |
2024-05-31 |
| sigma |
DNS Query To Ufile.io - DNS Client |
test |
2023-09-18 |
| sigma |
DNS Query To Ufile.io |
test |
2023-09-18 |
| sigma |
DNS Query To MEGA Hosting Website |
test |
2023-09-18 |
| sigma |
APT40 Dropbox Tool User Agent |
test |
2023-05-18 |
| sigma |
Rclone Config File Creation |
test |
2023-05-09 |
| sigma |
PUA - Rclone Execution |
test |
2023-03-05 |
| sigma |
DNS Query for Anonfiles.com Domain - Sysmon |
test |
2023-01-16 |
| sigma |
DNS Query To MEGA Hosting Website - DNS Client |
test |
2023-01-16 |
| sigma |
DNS Query for Anonfiles.com Domain - DNS Client |
test |
2023-01-16 |
| sigma |
Rclone Activity via Proxy |
test |
2022-10-18 |
| sigma |
Suspicious Dropbox API Usage |
test |
2022-04-20 |
| sentinel |
CreepyDrive URLs |
Scheduled |
— |
| sentinel |
CreepyDrive request URL sequence |
Scheduled |
— |