Network Connection to Suspicious Exfiltration Domains
This rule detects network connections from devices to a predefined list of domains commonly associated with data exfiltration services. Monitoring these connections can help identify attempts to transfer sensitive data out of the network.
Microsoft Sentinel (KQL)
