Threat Hunt: Network-Based hunting on High-Frequency HTTP/HTTPS Connections
This query identifies devices with frequent outbound HTTP/HTTPS connections to external IPs, suggesting possible chunked data exfiltration.
Microsoft Sentinel (KQL)
This query identifies devices with frequent outbound HTTP/HTTPS connections to external IPs, suggesting possible chunked data exfiltration.
Already have an account?