Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Ottercookie Detection

Steven Lim@KQLWizard

•updated Jul 1, 2025•3•1•71

KQL Query from file: Ottercookie Detection

Microsoft Sentinel (KQL)

Tags

S1011 - Tarrask TA0010 - Exfiltration T1020 - Automated Exfiltration T1567.004 - Exfiltration Over Webhook T1041 - Exfiltration Over C2 Channel T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol T1048.001 - Exfiltration Over Symmetric Encrypted Non-C2 Protocol T1567 - Exfiltration Over Web Service File Creation Network Connection HTTP Request Data Exfiltration Windows Windows Defender Atpkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?