Exfiltration Over Alternative Protocol `T1639`

Mobile Tactic: Exfiltration

Events covered

1 catalog event is tagged with this technique by at least one rule.

Provider	Event	Title
Defender-EmailEvents	any	Email processed

These 1 rule share fields, values, and exclusions.

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`AppId`	1	`eq` 1	`32780`
`AttachmentCount`	1	`gt` 1	`0`
`EmailDirection`	1	`eq` 1	`Outbound`
`Entities`	1	`contains` 1	`32780`, `account`
`Tactics`	1	`contains` 1	`exfiltration`
`Type`	1	`eq` 1	`account`

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`AppId`	`eq`	`32780` kustoDataverse - Terminated employee exfiltration over email	1
`AttachmentCount`	`gt`	`0` kustoDataverse - Terminated employee exfiltration over email	1
`EmailDirection`	`eq`	`Outbound` kustoDataverse - Terminated employee exfiltration over email	1
`Entities`	`contains`	`32780` kustoDataverse - Terminated employee exfiltration over email	1
`Entities`	`contains`	`account` kustoDataverse - Terminated employee exfiltration over email	1
`Tactics`	`contains`	`exfiltration` kustoDataverse - Terminated employee exfiltration over email	1	2
`Type`	`eq`	`account` kustoDataverse - Terminated employee exfiltration over email	1	13

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`RecipientDomain`	`eq`	`[]` kustoDataverse - Terminated employee exfiltration over email	1

These vendors publish rules tagged with this technique.

Domain: Endpoint