MITRE ATT&CK - Техника Автоматизированная эксфильтрация

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

Автоматизированная эксфильтрация

Sub-techniques (1)

ID	Name
.001	Дублирование трафика

Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection. When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over C2 Channel and Exfiltration Over Alternative Protocol.

ID: T1020

Суб-техники: .001

Тактика(-и): Exfiltration

Платформы: Linux, macOS, Network, Windows

Источники данных: Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Script: Script Execution

Версия: 1.2

Дата создания: 31 May 2017

Последнее изменение: 19 Apr 2022

Название	Описание
Примеры процедур
StrongPity	StrongPity can automatically exfiltrate collected documents to the C2 server.(Citation: Talos Promethium June 2020)(Citation: Bitdefender StrongPity June 2020)
LightNeuron	LightNeuron can be configured to automatically exfiltrate files under a specified directory.(Citation: ESET LightNeuron May 2019)
	During Frankenstein, the threat actors collected information via Empire, which was automatically sent back to the adversary's C2.(Citation: Talos Frankenstein June 2019)
Frankenstein	Frankenstein has collected information via Empire, which is automatically sent the data back to the adversary's C2.(Citation: Talos Frankenstein June 2019)
Sidewinder	Sidewinder has configured tools to automatically send collected files to attacker controlled servers.(Citation: ATT Sidewinder January 2021)
Empire	Empire has the ability to automatically send collected data back to the threat actors' C2.(Citation: Talos Frankenstein June 2019)
Doki	Doki has used a script that gathers information from a hardcoded list of IP addresses and uploads to an Ngrok URL.(Citation: Intezer Doki July 20)
Rover	Rover automatically searches for files on local drives based on a predefined list of file extensions and sends them to the command and control server every 60 minutes. Rover also automatically sends keylogger files and screenshots to the C2 server on a regular timeframe.(Citation: Palo Alto Rover)
OutSteel	OutSteel can automatically upload collected files to its C2 server.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
Peppy	Peppy has the ability to automatically exfiltrate files and keylogs.(Citation: Proofpoint Operation Transparent Tribe March 2016)
Machete	Machete’s collected files are exfiltrated automatically to remote servers.(Citation: ESET Machete July 2019)
Ebury	Ebury can automatically exfiltrate gathered SSH credentials.(Citation: ESET Windigo Mar 2014)
Ke3chang	Ke3chang has performed frequent and scheduled data exfiltration from compromised networks.(Citation: Microsoft NICKEL December 2021)
TajMahal	TajMahal has the ability to manage an automated queue of egress files and commands sent to its C2.(Citation: Kaspersky TajMahal April 2019)
Honeybee	Honeybee performs data exfiltration is accomplished through the following command-line command: `from (- --).txt`.(Citation: McAfee Honeybee)
USBStealer	USBStealer automatically exfiltrates collected files via removable media when an infected device connects to an air-gapped victim machine after initially being connected to an internet-enabled victim machine. (Citation: ESET Sednit USBStealer 2014)
Crutch	Crutch has automatically exfiltrated stolen files to Dropbox.(Citation: ESET Crutch December 2020)
Tropic Trooper	Tropic Trooper has used a copy function to automatically exfiltrate sensitive data from air-gapped systems using USB storage.(Citation: TrendMicro Tropic Trooper May 2020)
Gamaredon Group	Gamaredon Group has used modules that automatically upload gathered documents to the C2 server.(Citation: ESET Gamaredon June 2020)
ShimRatReporter	ShimRatReporter sent collected system and network information compiled into a report to an adversary-controlled C2.(Citation: FOX-IT May 2016 Mofang)
CosmicDuke	CosmicDuke exfiltrates collected files automatically over FTP to remote servers.(Citation: F-Secure Cosmicduke)
Attor	Attor has a file uploader plugin that automatically exfiltrates the collected data and log files to the C2 server.(Citation: ESET Attor Oct 2019)
TINYTYPHON	When a document is found matching one of the extensions in the configuration, TINYTYPHON uploads it to the C2 server.(Citation: Forcepoint Monsoon)

Контрмера	Описание
Контрмеры
Automated Exfiltration Mitigation	Identify unnecessary system utilities, scripts, or potentially malicious software that may be used to transfer data outside of a network, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)

Обнаружение

Monitor process file access patterns and network behavior. Unrecognized processes or scripts that appear to be traversing file systems and sending network traffic may be suspicious.

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.