Potential Data Exfiltration Activity to an Unusual Region

A machine learning job has detected data exfiltration to a particular geo-location (by region name). Data transfers to geo-locations that are outside the normal traffic patterns of an organization could indicate exfiltration over command and control channels.

ATT&CK coverage

Exfiltration

T1041Exfiltration Over C2 Channel 30 detections cover this technique

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.

Sign in to read it Create an account

Detection catalogue

ATT&CK coverage

Detection logic