Tag
Potential Data Exfiltration via Rclone
2 rules 3 TTPsAttackers are abusing the legitimate file synchronization tool rclone, often renamed to masquerade as legitimate software, to exfiltrate data to cloud storage or remote endpoints.
Trigona Ransomware Employing Custom Data Exfiltration Tool
2 rules 4 TTPs 1 IOCTrigona ransomware is using a custom data exfiltration tool named 'uploader_client.exe' to steal data from compromised environments, enhancing speed and evasion.
Unusual Spike in Bytes Written to External Device Detected by Machine Learning
2 rules 1 TTPA machine learning job has detected a spike in bytes written to an external device, which is anomalous and can signal illicit data copying or transfer activities, potentially leading to data exfiltration.
CrowdStrike Falcon AIDR Supports NVIDIA NeMo Guardrails for AI Agent Protection
2 rules 2 TTPsCrowdStrike Falcon AIDR now supports NVIDIA NeMo Guardrails, providing enterprise-grade protection for AI agents by defending against runtime attacks like prompt injection, redacting sensitive data, defanging malicious content, and moderating unwanted topics to ensure agents stay within compliance boundaries in sectors like finance, healthcare, customer service, and software development.
Speagle Malware Hijacks Cobra DocGuard for Data Exfiltration
2 rules 1 TTPThe Speagle malware hijacks the Cobra DocGuard application to exfiltrate sensitive data from infected machines to attacker-controlled Cobra DocGuard servers, effectively masking malicious traffic as legitimate DocGuard communication.
Apache Artemis and ActiveMQ Artemis Authentication Bypass Vulnerability
2 rules 5 TTPsCVE-2026-27446 allows an unauthenticated remote attacker to inject malicious messages or exfiltrate data from Apache Artemis and ActiveMQ Artemis brokers due to a missing authentication check in the Core protocol.
Potential Data Exfiltration to Unusual Geographic Region via Machine Learning
2 rules 1 TTPA machine learning job has detected potential data exfiltration activity to an unusual geographical region, specifically by region name, indicating exfiltration over command and control channels.
Unusual Remote File Size Indicating Lateral Movement
2 rules 3 TTPsA machine learning job has detected an unusually high file size shared by a remote host, indicating potential lateral movement as attackers bundle data into a single large file transfer to evade detection when exfiltrating valuable information.
Spike in Bytes Sent to an External Device via Airdrop
2 rules 1 TTPA machine learning job has detected a spike in bytes of data written to an external device via Airdrop, potentially indicating illicit data copying or transfer activities.
Machine Learning Detects High Bytes Written to External Device
2 rules 1 TTPA machine learning job has detected high bytes of data written to an external device, potentially indicating illicit data copying or transfer activities leading to data exfiltration over a physical medium such as USB.
Unusual Process Writing Data to an External Device via Machine Learning
2 rules 1 TTPA machine learning job detects a rare process writing data to an external device, potentially indicating data exfiltration masked by benign-looking processes.
Mounting of Hidden or WebDav Remote Shares via Net Utility
2 rules 4 TTPsAdversaries may leverage the `net.exe` utility to mount WebDav or hidden remote shares, potentially indicating lateral movement, data exfiltration preparation, or initial access via discovery of accessible shares.
Large ICMP Traffic Detection
2 rules 1 TTPThis analytic identifies excessive ICMP traffic to external IP addresses exceeding 1,000 bytes, potentially indicating command and control activity, data exfiltration, or covert communication channels.