Exfiltration Over Web Service detection rulesT1567

Detects suspicious user agent string of APT40 Dropbox tool

proxy

Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors

linux · network_connection

Detects an executable initiating a network connection to "ngrok" tunneling domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.

windows · network_connection

Detects usage of curl to upload files to known file sharing domains, which may indicate data exfiltration.

windows · process_creation

Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes

windows

Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes

windows · dns_query

Detects suspicious DNS queries to Monero mining pools

dns

Detects an executable initiating a network connection to "ngrok" domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.

windows · network_connection

Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc

windows · process_creation

Detects the execution of the Restic backup tool, which can be used for data exfiltration. Threat actors may leverage Restic to back up and exfiltrate sensitive data to remote storage locations, including cloud services. If not legitimately used in the enterprise environment, its presence may indicate malicious activity.

windows · process_creation

Detects an executable that isn't dropbox but communicates with the Dropbox API

windows · network_connection

Detects the execution of "ConfigSecurityPolicy.EXE", a binary part of Windows Defender used to manage settings in Windows Defender. Users can configure different pilot collections for each of the co-management workloads. It can be abused by attackers in order to upload or download files.

windows · process_creation

Detects DNS queries for subdomains related to MEGA sharing website

windows · dns_query

Detects DNS queries for subdomains related to MEGA sharing website

windows

Detects when a user performs data exfiltration by using DataSvcUtil.exe

windows · process_creation

Detects network connections to BTunnels domains initiated by a process on the system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

windows · network_connection

Detects network connections to Cloudflared tunnels domains initiated by a process on the system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

windows · network_connection

Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

windows · network_connection

Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

windows · network_connection

Detects the execution of the "curl" process with "upload" flags. Which might indicate potential data exfiltration

windows · process_creation

Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string

proxy

Detects Rclone config files being created

windows · file_event

Detects a suspicious curl process start the adds a file to a web request

linux · process_creation

Detects an a non-browser process interacting with the Telegram API which could indicate use of a covert C2

windows · network_connection

Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration

windows · dns_query

Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration

windows

Detects when a GitHub Pages site of a repository is made public. This usually is part of a publishing process but could indicate or lead to potential unauthorized exposure of sensitive information or code.

github

Detects a network connection initiated by a binary to "api.mega.co.nz". Attackers were seen abusing file sharing websites similar to "mega.nz" in order to upload/download additional payloads.

windows · network_connection