Operation Escaneo SSL Key and AD Data Exfil via nc to 62.171.185.97:8888
Detects evidence of potential data exfiltration activities including the execution of known exfiltration scripts, the use of netcat for unauthorized data transfer to a specific C2 IP, and the presence or access of BloodHound dump files. The rule also monitors for network communication with a known command and control IP address.
Microsoft Sentinel (KQL)
