Collection

← All KQL categories

MITRE ATT&CK Tactic

Collection

6 queries tagged with this tactic.
View on MITRE ATT&CK →

• Analytics Rules Detect Telegram Tdata Session Theft File Access

  Theft of Telegram's tdata session directory by an unexpected process. Uses actual DeviceFileEvents ActionTypes (FileCreated/Modified) — `FileRead` doesn't exist.

• Hunting Hunt Cloud Storage Bucket Lookalike References

  References to cloud storage buckets whose names are lookalikes of your real ones — homoglyphs, dashes-for-underscores, plausibly-typosquatted variants.

• Hunting / File Activity Detect Spring Boot Heapdump Artifact On Disk

  Detects Spring Boot Actuator heap-dump theft by the artifact Spring writes to disk during the request (`heapdumpgt;[-live]gt;.hprof`). The filename is proof an HTTP request hit the endpoint even when the web tier didn't log the URL.

• Hunting / File Activity File Activity Audit

  Timestamped file activity (open, read, modify, delete, create) by user and device. Written for a client that needed to demonstrate this capability to an auditor.

• Hunting / Web Tier Hunt Spring Boot Heapdump Exfiltration Asim

  Hunts Spring Boot Actuator heap-dump exfiltration in ASIM Web Session data by matching the endpoint ID as a path segment (position-independent) instead of hardcoding `/actuator/heapdump`. Recovers the real base path from traffic and ranks by response-size verdict.

• Hunting / Web Tier Hunt Spring Boot Heapdump Exfiltration Commonsecuritylog

  Non-ASIM (`CommonSecurityLog`) variant of the heap-dump hunt. Uses correct CEF field names (`ReceivedBytes` / `SentBytes`) and carries both byte directions because CEF doesn't tell you which side is the response.