Contagious Interview: Python/Node Exfiltration to Dropbox and GitHub After Credential Harvest
Detects potential data exfiltration by monitoring interpreter processes (Python, Node.js) that access sensitive local credential/configuration files and subsequently connect to known cloud storage or code repository APIs (Dropbox, GitHub, Google Cloud). The rule correlates file access events with network connection activity.
Microsoft Sentinel (KQL)
