attack.exfiltration — sigma-tag tag

Meaning and evidence boundary

Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.

Related pages

• Active Directory Structure Export Via Csvde.EXE · sigma-rule
• Arbitrary File Download Via ConfigSecurityPolicy.EXE · sigma-rule
• AWS EC2 VM Export Failure · sigma-rule
• AWS RDS Master Password Change · sigma-rule
• AWS S3 Data Management Tampering · sigma-rule
• AWS Snapshot Backup Exfiltration · sigma-rule
• Cisco Stage Data · sigma-rule
• Communication To Ngrok Tunneling Service - Linux · sigma-rule
• Communication To Ngrok Tunneling Service Initiated · sigma-rule
• Compressed File Creation Via Tar.EXE · sigma-rule
• Compressed File Extraction Via Tar.EXE · sigma-rule
• Copy From Or To Admin Share Or Sysvol Folder · sigma-rule
• Curl File Upload To File Sharing Websites · sigma-rule
• Data Compressed · sigma-rule
• Data Exfiltration to Unsanctioned Apps · sigma-rule
• Data Exfiltration with Wget · sigma-rule
• Data Export From MSSQL Table Via BCP.EXE · sigma-rule
• DNS Exfiltration and Tunneling Tools Execution · sigma-rule
• DNS Query for Anonfiles.com Domain - DNS Client · sigma-rule
• DNS Query for Anonfiles.com Domain - Sysmon · sigma-rule
• DNS Query To MEGA Hosting Website · sigma-rule
• DNS Query To MEGA Hosting Website - DNS Client · sigma-rule
• DNS Query To Ufile.io · sigma-rule
• DNS Query To Ufile.io - DNS Client · sigma-rule
• DNS TOR Proxies · sigma-rule
• Exports Critical Registry Keys To a File · sigma-rule
• Exports Registry Key To a File · sigma-rule
• Github Fork Private Repositories Setting Enabled/Cleared · sigma-rule
• GitHub Repository Pages Site Changed to Public · sigma-rule
• Github Repository/Organization Transferred · sigma-rule
• LOLBAS Data Exfiltration by DataSvcUtil.exe · sigma-rule
• Modification or Deletion of an AWS RDS Cluster · sigma-rule
• Monero Crypto Coin Mining Pool Lookup · sigma-rule
• MSSQL Destructive Query · sigma-rule
• Network Communication Initiated To Portmap.IO Domain · sigma-rule
• Network Connection Initiated To BTunnels Domains · sigma-rule
• Network Connection Initiated To Cloudflared Tunnels Domains · sigma-rule
• Network Connection Initiated To DevTunnels Domain · sigma-rule
• Network Connection Initiated To Mega.nz · sigma-rule
• Network Connection Initiated To Visual Studio Code Tunnels Domain · sigma-rule
• OpenCanary - FTP Login Attempt · sigma-rule
• OpenCanary - TFTP Request · sigma-rule
• Powershell DNSExfiltration · sigma-rule
• PowerShell ICMP Exfiltration · sigma-rule
• PowerShell Script With File Hostname Resolving Capabilities · sigma-rule
• PowerShell Script With File Upload Capabilities · sigma-rule
• Process Initiated Network Connection To Ngrok Domain · sigma-rule
• PUA - Rclone Execution · sigma-rule
• PUA - Restic Backup Tool Execution · sigma-rule
• Python WebServer Execution - Linux · sigma-rule
• Rclone Activity via Proxy · sigma-rule
• Rclone Config File Creation · sigma-rule
• Restore Public AWS RDS Instance · sigma-rule
• Split A File Into Pieces · sigma-rule
• Split A File Into Pieces - Linux · sigma-rule
• Suspicious Curl File Upload - Linux · sigma-rule
• Suspicious DNS Query with B64 Encoded String · sigma-rule
• Suspicious Dropbox API Usage · sigma-rule
• Suspicious Inbox Forwarding · sigma-rule
• Suspicious Non-Browser Network Communication With Telegram API · sigma-rule
• Suspicious Outbound SMTP Connections · sigma-rule
• Suspicious Redirection to Local Admin Share · sigma-rule
• Suspicious SQL Query · sigma-rule
• Suspicious WebDav Client Execution Via Rundll32.EXE · sigma-rule
• Suspicious Windows Strings In URI · sigma-rule
• Tap Driver Installation · sigma-rule
• Tap Driver Installation - Security · sigma-rule
• Tap Installer Execution · sigma-rule
• WebDav Client Execution Via Rundll32.EXE · sigma-rule
• WebDav Put Request · sigma-rule