MITRE ATT&CK technique
Automated Exfiltration detection rulesT1020
Automated Exfiltration (T1020) is a MITRE ATT&CK technique in the Exfiltration tactic. This page lists the 10 community-maintained Sigma detection rules in the library mapped to T1020 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target aws, windows, github.
Tactic
Modification or Deletion of an AWS RDS Cluster
highDetects modifications to an RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauthorized access, or exposure of sensitive information.
aws
Restore Public AWS RDS Instance
highDetects the recovery of a new public database instance from a snapshot. It may be a part of data exfiltration.
aws
AWS RDS Master Password Change
mediumDetects the change of database master password. It may be a part of data exfiltration.
aws
Github Fork Private Repositories Setting Enabled/Cleared
mediumDetects when the policy allowing forks of private and internal repositories is changed (enabled or cleared).
github
Github Repository/Organization Transferred
mediumDetects when a repository or an organization is being transferred to another location.
github
Mail Forwarding/Redirecting Activity In O365
mediumDetects email forwarding or redirecting activity in O365 Audit logs.
m365
Mail Forwarding/Redirecting Activity Via ExchangePowerShell Cmdlet
mediumDetects email forwarding or redirecting activity via ExchangePowerShell Cmdlet
windows · ps_script
PowerShell Script With File Hostname Resolving Capabilities
mediumDetects PowerShell scripts that have capabilities to read files, loop through them and resolve DNS host entries.
windows · ps_script
PowerShell Script With File Upload Capabilities
lowDetects PowerShell scripts leveraging the "Invoke-WebRequest" cmdlet to send data via either "PUT" or "POST" method.
windows · ps_script
Suspicious Inbox Forwarding
lowDetects when a Microsoft Cloud App Security reported suspicious email forwarding rules, for example, if a user created an inbox rule that forwards a copy of all emails to an external address.
m365