Exfiltration Over Alternative Protocol `T1639`

Mobile Tactic: Exfiltration

Events covered

1 catalog event is tagged with this technique by at least one rule.

Provider	Event	Title
Defender-EmailEvents	any	Email processed

These 1 rule share fields, values, and exclusions.

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`Entities`	1	`contains` 1	`32780`, `account`
`Tactics`	1	`contains` 1	`Exfiltration`

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)
`Entities`	`contains`	`32780` kustoDataverse - Terminated employee exfiltration over email	1
`Entities`	`contains`	`account` kustoDataverse - Terminated employee exfiltration over email	1
`Tactics`	`contains`	`Exfiltration` kustoDataverse - Terminated employee exfiltration over email	1

These vendors publish rules tagged with this technique.

Domain: Endpoint