Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Malicious NPM Packed - Exfiltration Attempts Identified through Discord and FTP Protocols

Martin Baran@Martinbaran

•updated Jul 4, 2025•3•1•81

KQL Query

Microsoft Sentinel (KQL)

Tags

TA0010 - Exfiltration T1020 - Automated Exfiltration T1567.004 - Exfiltration Over Webhook T1041 - Exfiltration Over C2 Channel T1567 - Exfiltration Over Web Service T1102 - Web Service T1572 - Protocol Tunneling T1071 - Application Layer Protocol T1059 - Command and Scripting Interpreter T1560 - Archive Collected Data TA0011 - Command and Control TA0002 - Execution TA0009 - Collection Network Connection Outbound Data Exfiltration Command Execution Windows Nodejs Runtime Generic Network Logkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?