Data Exfiltration and C2: Post-exploitation abuse of legitimate channels

Visibility Note

Data exfiltration and C2 channels are increasingly employing sophisticated evasion methods: DNS tunneling (abusing RFC 1035), domain redirection hidden behind CDNs, and standard HTTPS ports are among the leading techniques. For detection, abnormal DNS query volume and high-entropy subdomains should be monitored, an application-authenticated proxy architecture should be used at the network egress, and restrictive policies permitting egress only to approved destinations should be enforced.

This section's prerequisite is the Prevention & Hardening Section. Until the following blind spots are closed, detection signals are either never generated or generated too late:

Prevention ≠ detection distinction: JA3/JA4+ fingerprinting, beacon analysis, DNS entropy scoring, Sigma rules, UEBA — these are detection mechanisms. Egress allowlist, WDAC, tenant restriction — these are prevention mechanisms.

Introduction

Exfiltration detection cannot be done with a single tool. Because attackers abuse legitimate channels, signature-based AV is insufficient in most scenarios. Robust detection operates across four axes:

Realistic expectation: A single signal is rarely sufficient. High confidence comes from multi-source correlation.

Classic correlation (endpoint + network):

Sysmon EID 1 (7z execution)
     + EID 11 (archive to Temp directory)
     + EID 3  (outbound HTTPS connection)
     + Proxy POST volume anomaly
     = HIGH confidence exfil chain

2026 correlation (identity layer added):

EID 1 (7z/archiving)
   + Proxy/CDN upload anomaly
   + Entra: new OAuth app + Files.ReadWrite.All admin consent
   + MCAS: anomalous mass upload same time window
   = CRITICAL — malware-free SaaS exfil suspicion

Brutal truth: Depending on SOC capacity, attackers exploit the overnight and weekend advantage. T1029 (scheduled transfer) and low-and-slow beacon profiles are missed without off-hours baseline coverage. 24/7 correlation and automated triage are mandatory.

0. EID Glossary

EID = Sysmon Event ID as used here. Windows Security Event IDs are additionally indicated as Win EID.

1. Detection Architecture — Data Sources

┌─────────────────────────────────────────────────────────────────┐
│                        DETECTION LAYERS                         │
├──────────────┬──────────────┬──────────────┬───────────────────┤
│   Network    │   Endpoint   │   Identity   │   SaaS / CASB     │
│   (N/S)      │              │              │                   │
├──────────────┼──────────────┼──────────────┼───────────────────┤
│ Zeek         │ Sysmon       │ Entra Sign-in│ MCAS/MDCA         │
│ NetFlow/IPFIX│ EDR (MDE,    │ Graph Audit  │ Unified Audit Log │
│ Proxy logs   │ CrowdStrike) │ OAuth consent│ OAuth app audit   │
│ DNS logs     │ Win EVTX     │ Risk detect. │ GitHub audit log  │
│ TLS metadata │ PS Script Blk│ CAE logs     │ Slack Enterprise  │
│ JA3/JA4+     │              │              │                   │
├──────────────┴──────────────┴──────────────┴───────────────────┤
│               UEBA (user/host/department baseline)              │
└─────────────────────────────────────────────────────────────────┘
                              │
                    SIEM / SOAR (Elastic, Splunk, Sentinel)
                              │
                    Correlation + Sigma + MITRE mapping

Note: "MCAS" (Microsoft Cloud App Security) is now officially named Microsoft Defender for Cloud Apps (MDCA). Both refer to the same product.

Minimum Viable Stack (Budget-Constrained)

• Sysmon — Sysmon config (extended config is mandatory for EID 17/18 and EID 8/10; SwiftOnSecurity default config has EID 17/18 disabled)

• Zeek or Suricata + Eve JSON

• RITA (beacon analysis)

• Elastic Stack or Wazuh (Sigma-compatible)

• DNS query logging (on internal resolver)

• NetFlow (at minimum unsampled/1:1 from egress point in critical segments)

Enterprise Stack

Minimum + commercial NDR (ExtraHop, Vectra) + CASB/MDCA + commercial EDR + UEBA (Exabeam, Securonix, Sentinel UEBA).

2. DNS Tunneling Detection — T1071.004

DNS tunneling abuses the RFC 1035 query/response structure to carry data. iodine, dnscat2, and custom implants use this vector.

2.1 Statistical Signals

Thresholds are environment-specific. M365, security products, and CDN traffic may naturally exceed these thresholds. The values here are starting points; they must be calibrated against the organization's DNS baseline.

2.2 Shannon Entropy Calculation

import math
from collections import Counter

def shannon_entropy(s: str) -> float:
    if not s:
        return 0.0
    counts = Counter(s)
    length = len(s)
    return -sum((c / length) * math.log2(c / length) for c in counts.values())

# Verified reference values (calculated):
# "google"                  → 1.92  (legitimate, low entropy)
# "xk9f2m8q1p"              → 3.32  (medium — suspicious)
# "a1b2c3d4e5f6g7h8i9j0"   → 4.32  (high — tunneling signal)
# "MJQXGZLTMFRA2TKNFQWC2"  → 3.92  (Base32 — iodine payload)
#
# NOTE: Full subdomain string must be used for threshold calibration;
# single-word references are scale indicators only.

2.3 DNS Analysis with Zeek

Zeek dns.log fields: query, qtype_name, answers, TTLs, rcode_name.

dns.log → subdomain length filter
       → entropy calculation
       → grouping by apex domain
       → NRD check (passive DNS / WHOIS feed)
       → threshold exceeded → Notice::Suspicious_DNS_Encoding
       → endpoint correlation (Sysmon EID 1 + EID 22 same time window)
           ├─ EID 1: iodine / dnscat / unknown-location python-powershell (EncodedCommand)
           └─ EID 22: high-volume queries to same apex
       → (optional) resolver lock violation: external 53/udp observed (if Section 2 is active)
       → correlation match → HIGH severity / analyst queue
       → no correlation → LOW / no automatic block (CDN/security tool FP risk)

Notice name nuance: Notice::Suspicious_DNS_Encoding is not a standard Zeek package; it must be implemented as a custom script/notice. The @load directive and package dependencies must also be defined separately.

Zeek notice example (concept — custom script):

# @load base/protocols/dns
# @load custom/entropy   # shannon_entropy() defined here

event dns_request(c: connection, msg: dns_msg, query: string,
                  qtype: count, qclass: count)
{
    local sub = split_string(query, /\./)[0];
    if ( |sub| > 50 && shannon_entropy(sub) > 3.5 )
        NOTICE([$note=Suspicious_DNS_Encoding,
                $msg=fmt("High-entropy DNS query: %s", query),
                $conn=c,
                $identifier=query]);   # added: for dedup
}

Resolver cache note: If the internal resolver cache hit rate is high, query log volume decreases; logging should also be performed at the forwarder layer.

2.4 Sysmon EID 22 Correlation

DNS logs alone are not sufficient. Concurrent signals at the endpoint:

• EID 1: iodine.exe, dnscat, python from an unknown location

• EID 22: hundreds of queries to the same apex domain

• When resolver lock is in place (Section 2), external 53/udp observed → critical anomaly

Correlation rule:

 EID 22: count > 200 in 10m
  AND unique(subdomain) > 50
  AND avg(entropy) > 3.5
  AND (
    EID 1: process IN [iodine, dnscat]
    OR (EID 1: powershell.exe AND CommandLine CONTAINS [-enc, EncodedCommand])
  )
→ HIGH severity

2.5 DNS Log Sources

2.6 False Positive Sources

CrowdStrike, Defender, Akamai, Zscaler, and Cloudflare can generate high-entropy subdomains. M365 TXT records affect the environment baseline. Apple Private Relay, iCloud Private Relay, and Windows Update CDN should be allowlisted. Route to analyst rather than automatic block.

3. TLS Fingerprinting — JA3, JA3S, JARM, JA4+

Anomaly detection via metadata is possible even without TLS inspection.

3.1 JA3 / JA3S

JA3 generates a fingerprint from the TLS Client Hello: cipher suites, extensions, elliptic curves, EC point formats.

Correct approach:

• Baseline deviation: Profile differing from the corporate browser JA3 set

• Header inconsistency: User-Agent: Mozilla/5.0 but JA3 = Go HTTP client

• Tool profiles: rclone, curl, python-requests each produce different JA3

• Suspicious cluster: Many external hosts sharing the same JA3 + regular connections

Wrong approach: Labeling a single JA3 hash as a "Cobalt Strike profile." The same hash can also be produced by Sliver, Havoc, and Go implants; hash-to-malware-family mapping degrades over time.

Additional nuance: Chrome and Edge can produce different JA3/JA4 profiles over TCP vs QUIC/UDP. TCP and UDP 443 traffic from the same host must be evaluated with separate profile sets.

ssl.log: ja3 NOT IN corporate_browser_ja3_set
    AND dest_port = 443
    AND conn.log bytes_out > host_baseline × 10
    → suspicious C2/exfil profile

3.2 JARM

JARM is active fingerprinting: it probes the server to generate a TLS stack fingerprint.

Use case: Known C2 framework server clusters (same JARM + many IPs = infrastructure clustering); cross-validation with passive JA3.

Limitations: Can be altered with malleable profiles and JARM Randomizer. Legitimate software such as Zimbra can produce similar JARM. Not conclusive evidence on its own.

Operational cost: Requires active scanning. Most SOCs rely on passive NDR; JARM is more suitable for threat hunting and NDR teams. Passive JA3/JA4+ takes priority for daily SOC operations.

3.3 JA4+ — 2026 Recommended

JA4+ was developed by FoxIO; it is the successor to JA3 with a human-readable format, QUIC/HTTP3 support, and normalized hashes.

Zeek integration: JA4+ package (v0.18.8+) adds ja4, ja4s, ja4h fields to ssl.log and http.log.

ssl.log: ja4 NOT IN known_browser_ja4_set
    AND proto = udp/443
    AND bytes_out > host_baseline × 5
    → suspicious QUIC exfil

UDP/443 analysis via quic.log with Zeek 6.x QUIC support. JA4+ is the primary signal for QUIC/HTTP3 exfil detection.

3.4 Malleable C2 and Fingerprinting Limitations

• JA3/JA4+ alone is not sufficient

• JA3/JA4+ + HTTP header inconsistency + beacon timing must be evaluated together

• Domain fronting detection cannot be applied without TLS metadata visibility (Zeek ssl.log or proxy TLS inspection)

4. Beacon Analysis — RITA

RITA (Real Intelligence Threat Analytics) statistically scores C2 beacon behavior over NetFlow/Zeek conn.log.

4.1 Beacon Signals

4.2 Jitter and Modern C2 Limitations

Critical: Modern implants attempt to evade RITA with jitter, sleep mask, and adaptive beacon. RITA must not be left alone; host/user correlation and off-hours baseline are mandatory.

4.3 RITA v5 Usage

RITA v5, unlike v1–4, provides a terminal-based user interface (TUI); beacon, DNS tunneling, long connection, and threat intel detections are all displayed in a single location.

# Zeek conn.log import
rita import --logs=/var/log/zeek/ --rolling MyDataset

# View with TUI
rita view MyDataset

# Beacon filtering (v5 scale: 0–100 integer)
# In TUI: beacon:>=80
# or with threshold and sorting:
rita view MyDataset beacon:>=90 sort:duration-desc

# CSV output
rita view --stdout MyDataset beacon:>=80 > beacons.csv

RITA v5 score scale: 0 (random) → 100 (strongly periodic). Threshold: ≥ 80 high confidence; ≥ 90 very high confidence.

Legacy commands (v1–4): rita show-beacons, rita show-beacons --human-readable are not used in v5.

v5 TUI fields:

Field	Description
beacon	Combined beacon score (0–100)
severity	critical / high / medium / low
duration	Connection duration
subdomains	Subdomain count (DNS tunneling signal)
threat_intel	TI feed match

Output scores:

• TS Score — timestamp consistency (temporal regularity)

• DS Score — data size consistency (uniform size — T1030 signal)

• Beacon Score — combined score

4.4 T1041 + T1030 Correlation

RITA v5: beacon >= 80
AND conn.log: bytes_out > host_baseline × 10
AND ssl.log: ja4 NOT IN corporate_browser_set
→ T1041 (exfil over C2) suspicion — P1

5. Zeek — Network Detection Backbone

5.1 Critical Log Files

5.2 Domain Fronting Detection — T1090.004

Prerequisite: TLS metadata visibility (Zeek ssl.log or proxy TLS inspection). Without it, Host/SNI comparison cannot be applied.

http.log: host (Host header) ≠ ssl.log: server_name (SNI)
      → Domain fronting suspicion

Additional signals:

• SNI = CDN domain but POST body volume is well above the host baseline

• Fastly (February 2024), Azure Front Door (January 2024), AWS CloudFront (2018) blocked this at scale

• Active variants: Cloudflare Workers, Azure Functions, ngrok/Cloudflare Tunnel, Lambda@Edge relay — detection signal for these edge worker vectors: high-volume POST to unexpected CDN worker subdomain + regular connection cadence

5.3 HTTP POST Anomaly — T1567, T1041

Instead of a static MB threshold, use host baseline anomaly:

http.log: method = "POST"
AND request_body_len > host_90th_percentile × 5
AND user_agent MATCHES /rclone|curl|python|Go-http-client/
→ Suspicious bulk upload

Static threshold warning: Teams, OneDrive, and SharePoint already generate large POSTs; a static 10 MB threshold is a heavy source of false positives. Using the host baseline percentile dramatically reduces FPs.

5.4 QUIC / HTTP/3

Zeek 6.x + JA4+ QUIC fingerprinting. Closes the QUIC blind spot from Section 2 at the detection layer.

6. NetFlow / IPFIX Analysis

NetFlow provides flow metadata without packet contents.

6.1 Exfil Signals

6.2 Flow Sampling Risk

If the sampling rate is low (e.g. 1:1000), short burst exfil can escape detection. Unsampled or 1:1 flow is preferred on critical segments (data servers, egress points).

Managed DB exception: Managed database services such as Azure SQL and RDS legitimately generate outbound 443 egress. A destination allowlist exception must be added to the data-server rule.

6.3 Pipeline and Rules

Router/Switch → NetFlow v9/IPFIX → nfdump/nfsen → RITA
                                               → Elastic (flow index)

Bulk exfil rule:

src_ip IN [DB_SERVER_SUBNET]
AND dst_ip EXTERNAL
AND dst_ip NOT IN [managed_db_endpoints_allowlist]
AND bytes_out > 100MB in 1h
→ CRITICAL

Low-and-slow exfil rule (--bwlimit/throttle-aware):

src_ip IN [WORKSTATION_SUBNET]
AND dst_ip EXTERNAL
AND bytes_out BETWEEN 5MB AND 50MB per hour
AND duration > 4 hours
AND conn_count > 20
→ MEDIUM-HIGH (persistence signal)

Throttle-aware detection note: Akira and other ransomware operators deliberately use --bwlimit 5M during business hours to evade volume anomaly rules. The low-and-slow rule catches this pattern; static high-threshold rules miss it.

7. Sysmon and EDR Correlation

7.1 High-Value Correlation Chains

Chain A — Archiving + Exfil (T1560 → T1041/T1567)

EID 1:  Image IN [*\7z.exe, *\rar.exe, *\rclone.exe, *\azcopy.exe]
        AND (Prevalence=rare OR Signed=FALSE)
         → EID 11: TargetFilename CONTAINS [\Temp\, \Public\, \ProgramData\]
          → EID 3:  DestinationIp EXTERNAL AND DestinationPort = 443
           → Proxy: POST > host_baseline × 5 same time window
             = HIGH confidence — T1560 + T1041/T1567

Sigma/Sysmon note: Hashes NOT IN trusted_set cannot be applied directly as a filter in Sysmon. Use "rarely seen binary" in EDR (MDE: DeviceRareFileEvents) or a prevalence feed instead.

Chain B — LotL Download (T1105)

EID 1:  certutil.exe CommandLine CONTAINS [-urlcache, http]
  → EID 11: FileCreate (downloaded file)
    → EID 3:  EXTERNAL connection (download direction)
      = MEDIUM-HIGH — T1105 (Ingress Tool Transfer)

MITRE note: certutil -urlcache is most often a download/ingress operation → T1105. Labeling it as exfil (T1048) additionally requires upload/outbound evidence (EID 3 large bytes_out + staging file).

Chain C — BITS Exfil (T1197)

EID 11 (staging in Temp)
  → EID 1 (bitsadmin / Start-BitsTransfer)
   → EID 3 (external:443)
     + BITS Client Operational log (job URL, transfer direction)
       = MEDIUM-HIGH — T1197 (exfil) or T1105 (ingress), depending on direction evidence

Chain D — DNS Tunneling (T1071.004)

Zeek/resolver: per-apex entropy>3.5, count>200/10m, unique_subdomain>50
             → EID 22 same apex + same host
              → EID 1: iodine/dnscat/python(dnscat)  [= HIGH]
               → PS EncodedCommand only with Zeek+resolver+EID22 together [= MEDIUM]

Chain E — Staging + Cleanup (T1074 → T1560 → OPSEC)

ID 1 (7z/rar)
   → EID 11 (.7z/.rar in Temp or recycle bin)
    → EID 3 (external:443) + conn.log bytes_out↑
     → EID 23 (same file, <1s) = HIGH — T1560 + T1074 + T1041 + T1070.004

Chain F — Cobalt Strike Process Injection + C2 (T1055 + T1071)

EID 8/10 (suspicious pair)
  → EID 17/18 (pipe — static + custom)
    → EID 3 (external:443)
      + JA4+ / RITA beacon
      + EDR memory analysis
      + ProcessGuid correlation
       → HIGH — T1055 + T1071.001

EID 7 nuance: Because reflective loading bypasses the LoadLibrary API in most cases, EID 7 (ImageLoad) may not fire. The primary injection signals are EID 8 (CreateRemoteThread) and EID 10 (ProcessAccess) combined with memory analysis (EDR). EID 7 is a supplementary signal only.

Named pipe warning: Modern operators use custom pipe names. The default pipe signature alone is insufficient; behavioral correlation of pipe + injection + network connection is mandatory.

PowerShell downgrade note: Constrained Language Mode bypass is possible. Win EID 4104 Script Block + EID 1 EngineVersion must be monitored together.

7.2 Sysmon Configuration Recommendations

SwiftOnSecurity warning: EID 17/18 (PipeCreate/PipeConnect) are disabled in the default SwiftOnSecurity config.

7.3 EDR Behavior Rules

IR note: rclone config path: %APPDATA%\rclone\rclone.conf (Windows), ~/.config/rclone/rclone.conf (Linux). Read with rclone config show; passwords are stored with reversible obfuscation — a captured config exposes the entire exfil infrastructure.

8. EDR Network Telemetry

Modern EDR platforms consolidate process, network, and identity signals into a single event record.

Example MDE query (KQL):

DeviceProcessEvents
| where FileName in ("rclone.exe", "azcopy.exe", "7z.exe")
| join kind=inner (
    DeviceNetworkEvents
    | where RemotePort == 443
    | where RemoteUrl !has ".microsoft.com"
) on DeviceId, InitiatingProcessId
| project Timestamp, DeviceName, FileName, RemoteUrl, RemoteIP

Advantage: No separate proxy/Sysmon correlation required; full host-level visibility.

Limitation: Zeek/NetFlow is still required for servers, IoT devices, and network appliances where no agent is installed.

9. UEBA — Behavioral Baseline Detection

Beyond signature- and threshold-based rules, exfiltration is often caught through baseline deviation.

9.1 Baseline Dimensions

9.2 UEBA Signal Examples

User:     finans_analyst
Baseline: upload 50 MB/day, destination = SharePoint corporate tenant
Anomaly:  upload 8 GB/day, destination = dropbox.com API
Source:   MCAS/MDCA + proxy + Entra
→ CRITICAL — exfil contrary to department role

Host:     DEV-WS-042
Baseline: GitHub push 10 commits/day, ~5 MB
Anomaly:  500 MB single push, private repo, new PAT
→ HIGH — T1567.001

9.3 UEBA Tools and Limitations

Tools: Microsoft Sentinel UEBA, Exabeam, Securonix, Gurucul, MCAS/MDCA anomaly detection (SaaS UEBA), Elastic ML unsupervised anomaly.

UEBA limitation: Requires false positive tuning. A learning period of 2–4 weeks should be planned.

Privacy note: UEBA collects user behavior data. The scope of data collection, retention period, and access policy must be defined in accordance with GDPR/KVKK requirements.

10. Sigma Rules

Sigma is a platform-independent YAML format for log-based detection.

10.1 IOC-Based Rules

Rclone Execution (T1567.002):

title: PUA - Rclone Execution
id: e37db05d-d1f9-49c8-b464-cee1a4b25864
status: test
description: |
  Rclone aracının yürütülmesini tespit eder. REvil, Conti, FiveHands, Akira, DarkSide ve Egregor
  gibi fidye yazılımı operatörleri bu aracı bulutta veri sızdırma (T1567.002) için kullanmıştır.
  Dosya adı, PE OriginalFileName, Description ve CLI desenleri birlikte değerlendirilir.
  Binary rename atlatmasına karşı OriginalFileName alanı dahil edilmiştir.
references:
    - https://attack.mitre.org/techniques/T1567/002/
    - https://attack.mitre.org/software/S1040/
    - https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/
    - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware
    - https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a
    - https://labs.sentinelone.com/egregor-raas-continues-the-chaos-with-cobalt-strike-and-rclone
    - https://www.splunk.com/en_us/blog/security/darkside-ransomware-splunk-threat-update-and-detections.html
    - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_rclone_execution.yml
author: NewbieV35
tags:
    - attack.exfiltration
    - attack.t1567.002
logsource:
    product: windows
    category: process_creation
detection:
    selection_specific_options:
        CommandLine|contains|all:
            - '--config '
            - '--no-check-certificate '
            - ' copy '
    selection_rclone_img:
        - Image|endswith: '\rclone.exe'
        - OriginalFileName: 'rclone.exe'
        - Description: 'Rsync for cloud storage'
    selection_rclone_cli:
        CommandLine|contains:
            - 'pass'
            - 'user'
            - 'copy'
            - 'sync'
            - 'config'
            - 'lsd'
            - 'remote'
            - 'ls'
            - 'mega'
            - 'pcloud'
            - 'ftp'
            - 'ignore-existing'
            - 'auto-confirm'
            - 'transfers'
            - 'multi-thread-streams'
            - 'no-check-certificate '
    filter_legit_path:
        Image|startswith:
            - 'C:\Program Files\rclone\'
            - 'C:\Program Files (x86)\rclone\'
    condition: (selection_specific_options or all of selection_rclone_*) and not filter_legit_path
falsepositives:
    - Onaylı IT yedekleme/senkronizasyon operasyonları (servis hesabı ve path whitelist ile daraltılmalı)
    - rclone config, lsd, ls gibi exfil dışı bakım komutları
level: high

AzCopy Execution (T1567.002):

title: PUA - AzCopy / Azure Storage Explorer Execution
id: 8f3c2a1b-4d5e-6f7a-8b9c-0d1e2f325865
status: experimental
description: |
  AzCopy veya Azure Storage Explorer yürütülmesini tespit eder. Interlock (CISA AA25-203A)
  ve Rhysida gibi ransomware operatörleri bu araçları Azure Blob Storage'a veri sızdırmak
  için kullanmıştır (T1567.002). Dosya adı, OriginalFileName ve CLI desenleri birlikte
  değerlendirilir; yalnızca binary adına güvenilmez. Whitelist tüm dallara uygulanır.
references:
    - https://attack.mitre.org/techniques/T1567/002/
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-203a
    - https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-v10
    - https://www.forescout.com/blog/a-year-later-interlock-ransomware-keeps-leveling-up/
author: CybersecLab-NewbieV35
date: 2026-06-16
tags:
    - attack.exfiltration
    - attack.t1567.002
logsource:
    product: windows
    category: process_creation
detection:
    selection_azcopy_specific:
        CommandLine|contains|all:
            - 'azcopy'
            - 'blob.core.windows.net'
    selection_azcopy_img:
        - Image|endswith: '\azcopy.exe'
        - OriginalFileName: 'azcopy.exe'
    selection_azcopy_cli:
        CommandLine|contains:
            - ' copy '
            - ' sync '
            - 'dfs.core.windows.net'
            - 'file.core.windows.net'
            - '--recursive'
            - '--from-to=LocalBlob'
            - '--from-to=BlobLocal'
    selection_storage_explorer_img:
        - Image|endswith: '\StorageExplorer.exe'
        - OriginalFileName: 'StorageExplorer.exe'
    filter_legit_path:
        Image|startswith:
            - 'C:\Program Files\Microsoft Azure Storage Explorer\'
            - 'C:\Program Files (x86)\Microsoft Azure Storage Explorer\'
    condition: >
        (selection_azcopy_specific or selection_storage_explorer_img or
        (1 of selection_azcopy_img and selection_azcopy_cli))
        and not filter_legit_path
falsepositives:
    - Approved Azure migration and backup operations (should be narrowed with service account whitelist)
    - Legitimate blob management via Azure Storage Explorer GUI (filtered if running from whitelisted path)
    - Scheduled data transfers with AzCopy (change window + approved account)
level: high

certutil Ingress Tool Transfer (T1105):

title: Suspicious Download Via Certutil.EXE — Ingress Tool Transfer
id: 8f3c2a1b-4d5e-6f7a-8b9c-0d1e2f325866
status: test
description: |
  Certutil ile uzaktan dosya indirmeyi tespit eder (T1105 — Ingress Tool Transfer).
  Saldırganlar -urlcache, -verifyctl veya -URL flag'leri ile LOLBin indirme yapar.
  NOT: Bu kural exfil (T1048) değildir; upload kanıtı için EID 3 outbound + staging
  (EID 11) korelasyonu ayrıca gerekir. Zincir B ile birleştirilmelidir.
references:
    - https://attack.mitre.org/techniques/T1105/
    - https://lolbas-project.github.io/lolbas/Binaries/Certutil/
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
    - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_certutil_download.yml
    - https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/
    - https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin
author: CybersecLab-NewbieV35
tags:
    - attack.command-and-control
    - attack.t1105
    - attack.defense-evasion
    - attack.t1027
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\certutil.exe'
        - OriginalFileName: 'CertUtil.exe'
    selection_flags:
        CommandLine|contains:
            - 'urlcache '
            - '/urlcache '
            - 'verifyctl '
            - '/verifyctl '
            - 'URL '
    selection_http:
        CommandLine|contains: 'http'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium

10.2 Behavioral Rules — Sigma Correlation Format

IOC-only rules are bypassed by binary rename techniques such as rclone.exe → dllhosts.exe. Sigma correlation rules (pySigma Summer 2024+) should be used for behavioral correlation.

Staging + External Upload Correlation (T1560 + T1041) — correct Sigma correlation format:

# ── Rule 1: Archive staging ──────────────────────────────────
title: Archive Created in Staging Directory
id: 8f3c2a1b-4d5e-6f7a-8b9c-0d1e2f325867
author: CybersecLab-NewbieV35
name: archive_staging
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith:
            - '\7z.exe'
            - '\rar.exe'
            - '\7zG.exe'
            - '\7zFM.exe'
        TargetFilename|contains:
            - '\Temp\'
            - '\Public\'
            - '\ProgramData\'
    condition: selection

---
# ── Rule 2: External HTTPS (narrowed) ─────────────────────
title: External HTTPS Connection from Host
id: 8f3c2a1b-4d5e-6f7a-8b9c-0d1e2f325868
author: CybersecLab-NewbieV35
name: external_https
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated: 'true'
        DestinationPort: 443
    filter_private:
        DestinationIp|startswith:
            - '10.'
            - '192.168.'
            - '127.'
            - '169.254.'
            - '172.16.'
            - '172.17.'
            - '172.18.'
            - '172.19.'
            - '172.20.'
            - '172.21.'
            - '172.22.'
            - '172.23.'
            - '172.24.'
            - '172.25.'
            - '172.26.'
            - '172.27.'
            - '172.28.'
            - '172.29.'
            - '172.30.'
            - '172.31.'
    condition: selection and not 1 of filter_private

---
# ── Correlation rule (Sigma correlation spec v2.1) ────────────
title: Archive Staging Followed by External HTTPS — Exfil Chain
id: 8f3c2a1b-4d5e-6f7a-8b9c-0d1e2f325869
status: experimental
description: |
  T1560.001 (arşiv staging) ardından T1041 (external HTTPS) zinciri.
  IOC-only kuralların üzerine davranışsal korelasyon katmanı.
  NOT: Exfil kanıtı için upload hacmi (NetFlow/EDR) ile doğrulama önerilir.
  NOT 2: timespan statik pencere kullanır; 30dk sınırı tam ortadan
  geçen olaylarda (örn. 14:29 / 15:01) false negative riski taşır.
author: CybersecLab-NewbieV35
tags:
    - attack.t1560.001
    - attack.t1041
correlation:
    type: temporal_ordered
    rules:
        - archive_staging
        - external_https
    group-by:
        - ComputerName
    timespan: 30m
falsepositives:
    - Archive in Temp + legitimate HTTPS shortly after (browser, OneDrive sync)
    - Backup software staging + cloud upload
level: high

Sigma correlation note: timeframe + condition: A and B within a single rule is invalid. The correct format requires type: temporal or type: temporal_ordered with separate rule references and group-by. Backend support varies — pySigma backend compatibility must be verified for the target SIEM.

PowerShell Encoded Command + Network Activity (T1059.001):

# ── Rule 1: Encoded PowerShell ───────────────────────────────
title: Suspicious Encoded PowerShell Command Line
id: 8f3c2a1b-4d5e-6f7a-8b9c-0d1e2f325870
author: CybersecLab-NewbieV35
name: ps_encoded
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\powershell_ise.exe'
    selection_cli:
        CommandLine|contains:
            - ' -enc'
            - ' -EncodedCommand'
            - ' -ec '
            - ' -EncodedCommand '
    condition: all of selection_*
falsepositives:
    - Approved automation/script signing policies

---
# ── Rule 2: Outbound network (narrowed) ───────────────────
title: PowerShell Outbound Network Connection
id: 8f3c2a1b-4d5e-6f7a-8b9c-0d1e2f325871
author: CybersecLab-NewbieV35
name: ps_network
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\powershell_ise.exe'
        Initiated: 'true'
        DestinationPort: 443
    filter_private:
        DestinationIp|startswith:
            - '10.'
            - '192.168.'
            - '127.'
            - '169.254.'
            - '172.16.'
            - '172.17.'
            - '172.18.'
            - '172.19.'
            - '172.20.'
            - '172.21.'
            - '172.22.'
            - '172.23.'
            - '172.24.'
            - '172.25.'
            - '172.26.'
            - '172.27.'
            - '172.28.'
            - '172.29.'
            - '172.30.'
            - '172.31.'
    condition: selection and not 1 of filter_private

---
# ── Correlation rule ─────────────────────────────────────────
title: PowerShell Encoded Command with Network Activity
id: 8f3c2a1b-4d5e-6f7a-8b9c-0d1e2f325872
author: CybersecLab-NewbieV35
status: experimental
description: |
  T1059.001 — Encoded PowerShell ardından outbound HTTPS bağlantısı.
  Exfil değil; execution + C2/LotL indirme şüphesi. Child process ağ
  bağlantısı açarsa false negative riski — Win EID 4104 ile desteklenmeli.
references:
    - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_powershell_enc_cmd.yml
    - https://sigmahq.io/sigma-specification/specification/sigma-correlation-rules-specification.html
date: 2026-06-16
tags:
    - attack.t1059.001
    - attack.execution
correlation:
    type: temporal_ordered
    rules:
        - ps_encoded
        - ps_network
    group-by:
        - ComputerName
    timespan: 5m
falsepositives:
    - Approved PowerShell automation + legitimate HTTPS (Graph API, Azure)
    - Admin script deployment tools
level: medium

DNS High Query Length — Zeek (T1071.004):

title: High Query Length DNS — Possible Tunneling
id: 8f3c2a1b-4d5e-6f7a-8b9c-0d1e2f325873
author: CybersecLab-NewbieV35
status: experimental
description: |
    Detects unusually long DNS queries in Zeek logs, which may indicate DNS tunneling
    or data encoding in subdomain labels (T1071.004) and exfiltration (T1048.003).
    Full FQDN length is measured, not a single label. Single-event matches carry a high
    false positive rate from CDN base64 subdomains and security telemetry domains —
    correlate with the frequency rule (high-query-length-dns-frequency) and/or Sysmon
    EID 22 for higher confidence. Entropy scoring (e.g. Shannon entropy > 3.5) is
    recommended as second-stage filtering downstream; Sigma has no native entropy
    modifier so this cannot be expressed here.
references:
    - https://attack.mitre.org/techniques/T1071/004/
    - https://attack.mitre.org/techniques/T1048/003/
    - https://github.com/SigmaHQ/sigma/issues/1862
tags:
    - attack.command_and_control
    - attack.exfiltration
    - attack.t1071.004
    - attack.t1048.003
logsource:
    product: zeek
    service: dns
detection:
    selection:
        query|re: '^.{51,}\.?$'
    filter_internal:
        query|re: '\.(local|internal|corp|lan|home|localdomain)\.?$'
    filter_known_fp:
        query|re: '\.(cloudfront\.net|akamaiedge\.net|akamai\.net|akamaihd\.net|fastly\.net|edgekey\.net|edgesuite\.net)\.?$'
    condition: selection and not 1 of filter_*
falsepositives:
    - CDN base64-encoded subdomain labels (CloudFront, Akamai, Fastly, Edgekey)
    - Security product telemetry and update check URLs
    - Legitimate long hostnames in enterprise PKI or MDM
level: low

10.3 Conversion

sigma convert -t splunk -p sysmon rule.yml
sigma convert -t elastic-lucene -p sysmon rule.yml

Rule repository: SigmaHQ/sigma. MITRE tag filter: attack.exfiltration, attack.t1041, attack.t1567.

11. SaaS and Identity Layer Detection

11.1 Microsoft 365 / Graph API — T1537

Extended Graph vectors: The presence of Mail.Read / ChatMessage.Read and high-privilege OAuth scopes alone does not indicate exfiltration; they must be correlated with an actual transfer or access event (UAL, Graph Activity Logs, MDCA).

Correlation:

[Entra] Risky sign-in (unfamiliar location/device) — medium+ risk
  → [MDCA] Mass download or upload anomaly
    → [UAL or Graph Activity] Evidence of actual transfer:
         • FileDownloaded / FileSyncDownloadedFull / FileAccessed + high volume
           → T1567.002 (download / staging)
         • Cross-tenant FileUploaded / FileCopied or external site destination
           → T1537 (cross-tenant transfer)

11.2 Session Hijacking — T1539

Valid token + MFA bypass was observed in Interlock and Scattered Spider cases:

• Entra: use of the same token from different IP/geography

• CAE (Conditional Access Evaluation) token revocation anomaly

• Token Protection: PRT replay attempt from an unmanaged device

• Sign-in log: TokenIssuerType = AzureAD + RiskState = atRisk (same token from different device)

11.3 OAuth Consent Grant Anomalies

Entra Audit Log events: Consent to application, Add delegated permission grant, Add app role assignment grant.

11.4 GitHub / Slack / Teams

12. Channel → Detection Signal Summary Table

13. MITRE → Detection Playbook Matrix

T1071.004

query_len > 50 AND dns_entropy > 3.5 AND queries > 200/10m

Zeek dns.log

P1

T1572

ja4 NOT IN browser_set AND proto=udp/443

Zeek ssl.log

P1

T1567.002

user_agent~rclone/azcopy AND POST > host_baseline × 5

Proxy http.log

P1

T1537

mdca.mass_download AND oauth_consent AND entra.risky

CASB + UAL + Entra

P1

T1560.001

EID1=7z/rar/zip AND EID11=Temp AND EID3=external

Sysmon

P1

T1090.004

http.host != ssl.sni (TLS metadata required)

Zeek ssl.log + http.log

P2

T1074

EID11 archive AND EID23 delete within 1h

Sysmon

P2

T1030

rita ds_score high AND uniform_size

RITA

P2

T1197

EID1=bitsadmin/start-Bitstransfer AND EID3=443

Sysmon + BITS Operational log

P2

T1059.001

PS EncodedCommand AND EID3 external

Sysmon

P2

T1095

icmp bytes anomaly OR ptunnel process

Zeek/NIDS + Sysmon

P2

T1052.001

usb_write_event AND sensitive_label

MDE DLP/Intune

P2

T1029

bytes_out outside business_hours > 3× baseline

NetFlow + UEBA

P2

T1048.002

smtp external_recipient AND attachment > baseline

Zeek smtp.log

P2

T1539

token_reuse different_ip AND risk_state=atRisk

Entra Sign-in

P1

T1105

certutil -urlcache AND EID3 external

Sysmon

P2

14. Case Studies — Detection Perspective

14.1 CISA Akira — rclone Exfil (AA24-109A)

Attack: Bulk data exfiltration to cloud storage via rclone with --bwlimit throttling during business hours.

Detection signals:

• EID 1: rclone.exe or renamed binary (dllhosts.exe) — signature alone is insufficient

• Proxy: User-Agent: rclone/v* + large POST volume targeting mega.nz, backblazeb2.com

• EID 11: staging archive (WinRAR) — Temp/ProgramData and rclone.conf creation

• MDCA: anomalous external upload (if CASB is present)

• Low-and-slow NetFlow rule: Single-hour volume is low due to throttling; 4+ hour sustained activity is the signal

Lesson: Binary rename + bwlimit combination bypasses signature and static threshold rules. Behavioral Chain A + low-and-slow NetFlow + UEBA off-hours anomaly are required.

14.2 CISA Interlock — AzCopy (AA25-203A)

Attack: Exfil to Azure Blob Storage via AzCopy using a valid session token.

Detection signals:

• EID 1: azcopy.exe, StorageExplorer.exe + command line (copy, sync, blob URL)

• EID 3: *.blob.core.windows.net:443

• Azure Activity Log: anomalous PutBlob volume

• AzCopy log: %USERPROFILE%\.azcopy — UPLOADSUCCESSFUL records

• Entra: token reuse from different IP/ASN (non-interactive sign-in log)

14.3 SUNBURST — APT29 (2020)

Attack: Regular beacon, HTTPS C2 blended into legitimate SolarWinds Orion traffic.

Detection signals (retrospective):

• RITA beacon: regular connections under avsvmcloud.com — SUNBURST deliberately adds jitter to evade clustering detection

• JA3: deviation from SolarWinds Orion traffic

• Zeek: User-Agent: SolarWindowsOrionImprovementClient/* + destination domain ≠ api.solarwinds.com

• DNS: high entropy, AD domain encoded subdomain

Lesson: Cannot be caught by signature; DNS DGA + UA/destination mismatch + long-term analysis are critical.

14.4 DNS Tunneling — iodine/dnscat2

Detection signals:

• Zeek: high-entropy TXT/CNAME queries (Base32 iodine payload — ~3.92 entropy)

• Sysmon EID 22: hundreds of unique subdomains to the same apex

• Network: external 53/udp traffic (if Section 2 resolver lock is in place, this anomaly is critical)

14.5 Scattered Spider / UNC3944 — SaaS and Identity

Attack: Helpdesk impersonation, MFA fatigue, SIM swap, AiTM phishing, OAuth consent abuse.

Detection signals:

• Entra risky sign-in + MFA fatigue pattern

• OAuth consent abuse: new app + broad scope + unverified publisher + immediate bulk access

• MDCA mass download

• Token reuse from different IP/ASN after SIM swap (T1539)

Lesson: Identity layer is primary; consent alone is not sufficient — must be correlated with bulk access evidence.

14.6 FIN7 — Staging + Exfil Chain

Attack: Multi-stage lateral movement, staging, rclone/AzCopy, off-hours upload.

Detection signals:

• EID 11: staging (7z/RAR) + new host after lateral movement

• rclone/MEGAsync + off-hours upload

• RITA: nighttime beacon profile

Lesson: A single signal is insufficient — staging→exfil→cleanup correlation + UEBA off-hours anomaly must be used.

15. SOC Operations — Triage and Escalation

15.1 Priority Matrix

15.2 Off-Hours — T1029

NetFlow: bytes_out BETWEEN 00:00–06:00
         AND src IN [workstation_subnet]
         AND src NOT IN [backup_servers]
         AND bytes_out > 3× user_baseline
         → MEDIUM-HIGH

15.3 False Positive Management

16. Detection Maturity Model

17. Common Detection Mistakes

24

Expecting native DNS entropy in Zeek

Calculate entropy with SIEM/RITA/script

Zeek only provides basic DNS data

25

Using only EID 3 for BITS exfil

BITS Operational Log + EID 1 correlation

EID 3 does not show the BITS channel

18. References

MITRE ATT&CK

• T1041 — Exfiltration Over C2 Channel

• T1071.004 — Application Layer Protocol: DNS

• T1071.001 — Application Layer Protocol: Web Protocols

• T1567.002 — Exfiltration to Cloud Storage

• T1567.001 — Exfiltration to Code Repository

• T1537 — Transfer Data to Cloud Account

• T1539 — Steal Web Session Cookie

• T1572 — Protocol Tunneling

• T1573 — Encrypted Channel

• T1090.004 — Proxy: Domain Fronting

• T1560 — Archive Collected Data

• T1030 — Data Transfer Size Limits

• T1029 — Scheduled Transfer

• T1074 — Data Staged

• T1095 — Non-Application Layer Protocol

• T1197 — BITS Jobs

• T1059.001 — Command and Scripting: PowerShell

• T1052.001 — Exfiltration via USB

• T1055 — Process Injection

• T1105 — Ingress Tool Transfer

TLS Fingerprinting

• JA3/JA3S — Salesforce Engineering

• JARM — Salesforce Engineering

• FoxIO JA4+ GitHub

• Zeek — JA4 Network Fingerprints (2026)

Tools and Technical References

• RITA v5 — Active Countermeasures

• RITA v5 GitHub

• SigmaHQ/sigma — Rule Repository

• Sigma Correlation Specification

• SwiftOnSecurity/sysmon-config

• olcortez/sysmon-config (extended)

• iodine DNS tunneling

• dnscat2 protocol documentation

• The DFIR Report — Cobalt Strike Defender's Guide Part 2

• Cobalt Strike Process Injection — HelpSystems

Threat Intelligence and Case Studies

• CISA #StopRansomware: Akira — AA24-109A

• CISA Advisory: Interlock Ransomware — AA25-203A

• Mandiant SUNBURST Analysis

• SafeDNS — DNS Tunneling Detection 2025

Microsoft / Identity

• Microsoft Defender for Cloud Apps (MDCA)

• Microsoft Unified Audit Log

• Microsoft Entra ID — Identity Protection

• Microsoft Entra Audit — Consent Events

• Continuous Access Evaluation (CAE)