Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Эксфильтрация через канал управления

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.

ID: T1041

Тактика(-и): Exfiltration

Платформы: Linux, macOS, Windows

Источники данных: Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow

Версия: 2.2

Дата создания: 31 May 2017

Последнее изменение: 07 Apr 2023

Название	Описание
Примеры процедур
MechaFlounder	MechaFlounder has the ability to send the compromised user's account name and hostname within a URL to C2.(Citation: Unit 42 MechaFlounder March 2019)
PoetRAT	PoetRAT has exfiltrated data over the C2 channel.(Citation: Talos PoetRAT October 2020)
ShimRatReporter	ShimRatReporter sent generated reports to the C2 via HTTP POST requests.(Citation: FOX-IT May 2016 Mofang)
Shark	Shark has the ability to upload files from the compromised host over a DNS or HTTP C2 channel.(Citation: ClearSky Siamesekitten August 2021)
SLOTHFULMEDIA	SLOTHFULMEDIA has sent system information to a C2 server via HTTP and HTTPS POST requests.(Citation: CISA MAR SLOTHFULMEDIA October 2020)
OutSteel	OutSteel can upload files from a compromised host over its C2 channel.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
Bandook	Bandook can upload files from a victim's machine over the C2 channel.(Citation: CheckPoint Bandook Nov 2020)
HotCroissant	HotCroissant has the ability to download files from the infected host to the command and control (C2) server.(Citation: Carbon Black HotCroissant April 2020)
DnsSystem	DnsSystem can exfiltrate collected data to its C2 server.(Citation: Zscaler Lyceum DnsSystem June 2022)
Machete	Machete's collected data is exfiltrated over the same channel used for C2.(Citation: ESET Machete July 2019)
Bumblebee	Bumblebee can send collected data in JSON format to C2.(Citation: Google EXOTIC LILY March 2022)
AppleJeus	AppleJeus has exfiltrated collected host information to a C2 server.(Citation: CISA AppleJeus Feb 2021)
NightClub	NightClub can use SMTP and DNS for file exfiltration and C2.(Citation: MoustachedBouncer ESET August 2023)
WarzoneRAT	WarzoneRAT can send collected victim data to its C2 server.(Citation: Check Point Warzone Feb 2020)
Torisma	Torisma can send victim data to an actor-controlled C2 server.(Citation: McAfee Lazarus Nov 2020)
SUGARDUMP	SUGARDUMP has sent stolen credentials and other data to its C2 server.(Citation: Mandiant UNC3890 Aug 2022)
Squirrelwaffle	Squirrelwaffle has exfiltrated victim data using HTTP POST requests to its C2 servers.(Citation: ZScaler Squirrelwaffle Sep 2021)
LuminousMoth	LuminousMoth has used malware that exfiltrates stolen data to its C2 server.(Citation: Kaspersky LuminousMoth July 2021)
Sandworm Team	Sandworm Team has sent system information to its C2 server using HTTP.(Citation: ESET Telebots Dec 2016)
Chimera	Chimera has used Cobalt Strike C2 beacons for data exfiltration.(Citation: NCC Group Chimera January 2021)
	During HomeLand Justice, threat actors used HTTP to transfer data from compromised Exchange servers.(Citation: CISA Iran Albanian Attacks September 2022)
FoggyWeb	FoggyWeb can remotely exfiltrate sensitive information from a compromised AD FS server.(Citation: MSTIC FoggyWeb September 2021)
Carberp	Carberp has exfiltrated data via HTTP to already established C2 servers.(Citation: Prevx Carberp March 2011)(Citation: Trusteer Carberp October 2010)
Misdat	Misdat has uploaded files and data to its C2 servers.(Citation: Cylance Dust Storm)
LunarMail	LunarMail can use email image attachments with embedded data for receiving C2 commands and data exfiltration.(Citation: ESET Turla Lunar toolset May 2024)
Woody RAT	Woody RAT can exfiltrate files from an infected machine to its C2 server.(Citation: MalwareBytes WoodyRAT Aug 2022)
StrongPity	StrongPity can exfiltrate collected documents through C2 channels.(Citation: Talos Promethium June 2020)(Citation: Bitdefender StrongPity June 2020)
NETEAGLE	NETEAGLE is capable of reading files over the C2 channel.(Citation: FireEye APT30)
GALLIUM	GALLIUM used Web shells and HTRAN for C2 and to exfiltrate data.(Citation: Cybereason Soft Cell June 2019)
Higaisa	Higaisa exfiltrated data over its C2 channel.(Citation: Zscaler Higaisa 2020)
XCSSET	XCSSET exfiltrates data stolen from a system over its C2 channel.(Citation: trendmicro xcsset xcode project 2020)
Empire	Empire can send data gathered from a target through the command and control channel.(Citation: Github PowerShell Empire)(Citation: Talos Frankenstein June 2019)
Pupy	Pupy can send screenshots files, keylogger data, files, and recorded audio back to the C2 server.(Citation: GitHub Pupy)
LightNeuron	LightNeuron exfiltrates data over its email C2 channel.(Citation: ESET LightNeuron May 2019)
Grandoreiro	Grandoreiro can send data it retrieves to the C2 server.(Citation: ESET Grandoreiro April 2020)
TrickBot	TrickBot can send information about the compromised host and upload data to a hardcoded C2 server.(Citation: Cyberreason Anchor December 2019)(Citation: Bitdefender Trickbot VNC module Whitepaper 2021)
STARWHALE	STARWHALE can exfiltrate collected data to its C2 servers.(Citation: DHS CISA AA22-055A MuddyWater February 2022)
BLUELIGHT	BLUELIGHT has exfiltrated data over its C2 channel.(Citation: Volexity InkySquid BLUELIGHT August 2021)
QakBot	QakBot can send stolen information to C2 nodes including passwords, accounts, and emails.(Citation: Kaspersky QakBot September 2021)
Ursnif	Ursnif has used HTTP POSTs to exfil gathered information.(Citation: TrendMicro Ursnif Mar 2015)(Citation: FireEye Ursnif Nov 2017)(Citation: ProofPoint Ursnif Aug 2016)
Frankenstein	Frankenstein has collected information via Empire, which is automatically sent the data back to the adversary's C2.(Citation: Talos Frankenstein June 2019)
Cannon	Cannon exfiltrates collected data over email via SMTP/S and POP3/S C2 channels.(Citation: Unit42 Cannon Nov 2018)
DarkGate	DarkGate uses existing command and control channels to retrieve captured cryptocurrency wallet credentials.(Citation: Ensilo Darkgate 2018)
CharmPower	CharmPower can exfiltrate gathered data to a hardcoded C2 URL via HTTP POST.(Citation: Check Point APT35 CharmPower January 2022)
Octopus	Octopus has uploaded stolen files and data from a victim's machine over its C2 channel.(Citation: Securelist Octopus Oct 2018)
S-Type	S-Type has uploaded data and files from a compromised host to its C2 servers.(Citation: Cylance Dust Storm)
Ke3chang	Ke3chang transferred compressed and encrypted RAR files containing exfiltration through the established backdoor command and control channel during operations.(Citation: Mandiant Operation Ke3chang November 2014)
SVCReady	SVCReady can send collected data in JSON format to its C2 server.(Citation: HP SVCReady Jun 2022)
APT39	APT39 has exfiltrated stolen victim data through C2 communications.(Citation: FBI FLASH APT39 September 2020)
Metamorfo	Metamorfo can send the data it collects to the C2 server.(Citation: ESET Casbaneiro Oct 2019)
REvil	REvil can exfiltrate host and malware information to C2 servers.(Citation: Secureworks REvil September 2019)
MobileOrder	MobileOrder exfiltrates data to its C2 server over the same protocol as C2 communications.(Citation: Scarlet Mimic Jan 2016)
Emotet	Emotet has exfiltrated data over its C2 channel.(Citation: Trend Micro Emotet Jan 2019)(Citation: Binary Defense Emotes Wi-Fi Spreader)
Lazarus Group	Lazarus Group has exfiltrated data and files over a C2 channel through its various tools and malware.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Loaders)(Citation: McAfee Lazarus Resurfaces Feb 2018)
Amadey	Amadey has sent victim data to its C2 servers.(Citation: BlackBerry Amadey 2020)
GoldenSpy	GoldenSpy has exfiltrated host environment information to an external C2 domain via port 9006.(Citation: Trustwave GoldenSpy June 2020)
DustySky	DustySky has exfiltrated data to the C2 server.(Citation: Kaspersky MoleRATs April 2019)
Zebrocy	Zebrocy has exfiltrated data to the designated C2 server using HTTP POST requests.(Citation: Accenture SNAKEMACKEREL Nov 2018)(Citation: CISA Zebrocy Oct 2020)
Remexi	Remexi performs exfiltration over BITSAdmin, which is also used for the C2 channel.(Citation: Securelist Remexi Jan 2019)
Doki	Doki has used Ngrok to establish C2 and exfiltrate data.(Citation: Intezer Doki July 20)
Kevin	Kevin can send data from the victim host through a DNS C2 channel.(Citation: Kaspersky Lyceum October 2021)
Manjusaka	Manjusaka data exfiltration takes place over HTTP channels.(Citation: Talos Manjusaka 2022)
IceApple	IceApple's Multi File Exfiltrator module can exfiltrate multiple files from a compromised host as an HTTP response over C2.(Citation: CrowdStrike IceApple May 2022)
TajMahal	TajMahal has the ability to send collected files over its C2.(Citation: Kaspersky TajMahal April 2019)
AuTo Stealer	AuTo Stealer can exfiltrate data over actor-controlled C2 servers via HTTP or TCP.(Citation: MalwareBytes SideCopy Dec 2021)
APT3	APT3 has a tool that exfiltrates data over the C2 channel.(Citation: FireEye Clandestine Fox)
	During C0017, APT41 used its Cloudflare services C2 channels for data exfiltration.(Citation: Mandiant APT41)
Pikabot	During the initial Pikabot command and control check-in, Pikabot will transmit collected system information encrypted using RC4.(Citation: Elastic Pikabot 2024)
	During Operation Honeybee, the threat actors uploaded stolen files to their C2 servers.(Citation: McAfee Honeybee)
FunnyDream	FunnyDream can execute commands, including gathering user information, and send the results to C2.(Citation: Bitdefender FunnyDream Campaign November 2020)
Cuckoo Stealer	Cuckoo Stealer can send information about the targeted system to C2 including captured passwords, OS build, hostname, and username.(Citation: Kandji Cuckoo April 2024)
CHIMNEYSWEEP	CHIMNEYSWEEP can upload collected files to the command-and-control server.(Citation: Mandiant ROADSWEEP August 2022)
APT32	APT32's backdoor has exfiltrated data using the already opened channel with its C&C server.(Citation: ESET OceanLotus Mar 2019)
	During Operation Dream Job, Lazarus Group exfiltrated data from a compromised host to actor-controlled C2 servers.(Citation: ClearSky Lazarus Aug 2020)
Stuxnet	Stuxnet sends compromised victim information via HTTP.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)
HOPLIGHT	HOPLIGHT has used its C2 channel to exfiltrate data.(Citation: US-CERT HOPLIGHT Apr 2019)
Okrum	Data exfiltration is done by Okrum using the already opened channel with the C2 server.(Citation: ESET Okrum July 2019)
Astaroth	Astaroth exfiltrates collected information from its r1.log file to the external C2 server. (Citation: Cybereason Astaroth Feb 2019)
Crimson	Crimson can exfiltrate stolen information over its C2.(Citation: Cisco Talos Transparent Tribe Education Campaign July 2022)
HAWKBALL	HAWKBALL has sent system information and files over the C2 channel.(Citation: FireEye HAWKBALL Jun 2019)
SharpDisco	SharpDisco can load a plugin to exfiltrate stolen files to SMB shares also used in C2.(Citation: MoustachedBouncer ESET August 2023)
Lokibot	Lokibot has the ability to initiate contact with command and control (C2) to exfiltrate stolen data.(Citation: FSecure Lokibot November 2019)
ROKRAT	ROKRAT can send collected files back over same C2 channel.(Citation: Talos ROKRAT)
BoxCaon	BoxCaon uploads files and data from a compromised host over the existing C2 channel.(Citation: Checkpoint IndigoZebra July 2021)
ThiefQuest	ThiefQuest exfiltrates targeted file extensions in the `/Users/` folder to the command and control server via unencrypted HTTP. Network packets contain a string with two pieces of information: a file path and the contents of the file in a base64 encoded string.(Citation: wardle evilquest partii)(Citation: reed thiefquest ransomware analysis)
Attor	Attor has exfiltrated data over the C2 channel.(Citation: ESET Attor Oct 2019)
Cyclops Blink	Cyclops Blink has the ability to upload exfiltrated files to a C2 server.(Citation: NCSC Cyclops Blink February 2022)
EVILNUM	EVILNUM can upload files over the C2 channel from the infected host.(Citation: Prevailion EvilNum May 2020)
BLINDINGCAN	BLINDINGCAN has sent user and system information to a C2 server via HTTP POST requests.(Citation: NHS UK BLINDINGCAN Aug 2020)(Citation: US-CERT BLINDINGCAN Aug 2020)
Latrodectus	Latrodectus can exfiltrate encrypted system information to the C2 server.(Citation: Latrodectus APR 2024)(Citation: Bitsight Latrodectus June 2024)
SysUpdate	SysUpdate has exfiltrated data over its C2 channel.(Citation: Lunghi Iron Tiger Linux)
MarkiRAT	MarkiRAT can exfiltrate locally stored data via its C2.(Citation: Kaspersky Ferocious Kitten Jun 2021)
MacMa	MacMa exfiltrates data from a supplied path over its C2 channel.(Citation: ESET DazzleSpy Jan 2022)
Valak	Valak has the ability to exfiltrate data over the C2 channel.(Citation: Cybereason Valak May 2020)(Citation: Unit 42 Valak July 2020)(Citation: SentinelOne Valak June 2020)
PowerShower	PowerShower has used a PowerShell document stealer module to pack and exfiltrate .txt, .pdf, .xls or .doc files smaller than 5MB that were modified during the past two days.(Citation: Kaspersky Cloud Atlas August 2019)
StrifeWater	StrifeWater can send data and files from a compromised host to its C2 server.(Citation: Cybereason StrifeWater Feb 2022)
Mafalda	Mafalda can send network system data and files to its C2 server.(Citation: SentinelLabs Metador Sept 2022)
Kimsuky	Kimsuky has exfiltrated data over its C2 channel.(Citation: Securelist Kimsuky Sept 2013)(Citation: Talos Kimsuky Nov 2021)
BACKSPACE	Adversaries can direct BACKSPACE to upload files to the C2 Server.(Citation: FireEye APT30)
Chrommme	Chrommme can exfiltrate collected data via C2.(Citation: ESET Gelsemium June 2021)
Industroyer	Industroyer sends information about hardware profiles and previously-received commands back to the C2 server in a POST-request.(Citation: ESET Industroyer)
SombRAT	SombRAT has uploaded collected data and files from a compromised host to its C2 server.(Citation: BlackBerry CostaRicto November 2020)
FlawedAmmyy	FlawedAmmyy has sent data collected from a compromised host to its C2 servers.(Citation: Korean FSI TA505 2020)
ZIRCONIUM	ZIRCONIUM has exfiltrated files via the Dropbox API C2.(Citation: Zscaler APT31 Covid-19 October 2020)
SMOKEDHAM	SMOKEDHAM has exfiltrated data to its C2 server.(Citation: FireEye SMOKEDHAM June 2021)
Flagpro	Flagpro has exfiltrated data to the C2 server.(Citation: NTT Security Flagpro new December 2021)
AppleSeed	AppleSeed can exfiltrate files via the C2 channel.(Citation: Malwarebytes Kimsuky June 2021)
SILENTTRINITY	SILENTTRINITY can transfer files from an infected host to the C2 server.(Citation: GitHub SILENTTRINITY Modules July 2019)
Drovorub	Drovorub can exfiltrate files over C2 infrastructure.(Citation: NSA/FBI Drovorub August 2020)
Caterpillar WebShell	Caterpillar WebShell can upload files over the C2 channel.(Citation: ClearSky Lebanese Cedar Jan 2021)
KOPILUWAK	KOPILUWAK has exfiltrated collected data to its C2 via POST requests.(Citation: Mandiant Suspected Turla Campaign February 2023)
	During Operation Wocao, threat actors used the XServer backdoor to exfiltrate data.(Citation: FoxIT Wocao December 2019)
Raccoon Stealer	Raccoon Stealer uses existing HTTP-based command and control channels for exfiltration.(Citation: S2W Racoon 2022)(Citation: Sekoia Raccoon1 2022)(Citation: Sekoia Raccoon2 2022)
Imminent Monitor	Imminent Monitor has uploaded a file containing debugger logs, network information and system information to the C2.(Citation: QiAnXin APT-C-36 Feb2019)
Psylo	Psylo exfiltrates data to its C2 server over the same protocol as C2 communications.(Citation: Scarlet Mimic Jan 2016)
Pteranodon	Pteranodon exfiltrates screenshot files to its C2 server.(Citation: Palo Alto Gamaredon Feb 2017)
Kessel	Kessel has exfiltrated information gathered from the infected system to the C2 server.(Citation: ESET ForSSHe December 2018)
metaMain	metaMain can upload collected files and data to its C2 server.(Citation: SentinelLabs Metador Technical Appendix Sept 2022)
SideTwist	SideTwist has exfiltrated data over its C2 channel.(Citation: Check Point APT34 April 2021)
SDBbot	SDBbot has sent collected data from a compromised host to its C2 servers.(Citation: Korean FSI TA505 2020)
Confucius	Confucius has exfiltrated stolen files to its C2 server.(Citation: TrendMicro Confucius APT Aug 2021)
Bisonal	Bisonal has added the exfiltrated data to the URL over the C2 channel.(Citation: Talos Bisonal Mar 2020)
Rising Sun	Rising Sun can send data gathered from the infected machine via HTTP POST request to the C2.(Citation: McAfee Sharpshooter December 2018)
Winter Vivern	Winter Vivern delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP.(Citation: CERT-UA WinterVivern 2023)
IPsec Helper	IPsec Helper exfiltrates specific files through its command and control framework.(Citation: SentinelOne Agrius 2021)
njRAT	njRAT has used HTTP to receive stolen information from the infected machine.(Citation: Trend Micro njRAT 2018)
KGH_SPY	KGH_SPY can exfiltrate collected information from the host to the C2 server.(Citation: Cybereason Kimsuky November 2020)
DUSTTRAP	DUSTTRAP can exfiltrate collected data over C2 channels.(Citation: Google Cloud APT41 2024)
Mongall	Mongall can upload files and information from a compromised host to its C2 server.(Citation: SentinelOne Aoqin Dragon June 2022)
Mispadu	Mispadu can sends the collected financial data to the C2 server.(Citation: ESET Security Mispadu Facebook Ads 2019)(Citation: SCILabs Malteiro 2021)
Wizard Spider	Wizard Spider has exfiltrated domain credentials and network enumeration information over command and control (C2) channels.(Citation: CrowdStrike Grim Spider May 2019)(Citation: Mandiant FIN12 Oct 2021)
Proxysvc	Proxysvc performs data exfiltration over the control server channel using a custom protocol.(Citation: McAfee GhostSecret)
KONNI	KONNI has sent data and files to its C2 server.(Citation: Talos Konni May 2017)(Citation: Malwarebytes Konni Aug 2021)(Citation: Malwarebytes KONNI Evolves Jan 2022)
Sliver	Sliver can exfiltrate files from the victim using the `download` command.(Citation: GitHub Sliver Download)
PcShare	PcShare can upload files and information from a compromised host to its C2 servers.(Citation: Bitdefender FunnyDream Campaign November 2020)
Agrius	Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers.(Citation: Unit42 Agrius 2023)
Tomiris	Tomiris can upload files matching a hardcoded set of extensions, such as .doc, .docx, .pdf, and .rar, to its C2 server.(Citation: Kaspersky Tomiris Sep 2021)
Penquin	Penquin can execute the command code `do_upload` to send files to C2.(Citation: Leonardo Turla Penquin May 2020)
CreepySnail	CreepySnail can connect to C2 for data exfiltration.(Citation: Microsoft POLONIUM June 2022)
Bankshot	Bankshot exfiltrates data over its C2 channel.(Citation: McAfee Bankshot)
	During Frankenstein, the threat actors collected information via Empire, which sent the data back to the adversary's C2.(Citation: Talos Frankenstein June 2019)
Leviathan	Leviathan has exfiltrated data over its C2 channel.(Citation: CISA AA21-200A APT40 July 2021)
Mis-Type	Mis-Type has transmitted collected files and data to its C2 server.(Citation: Cylance Dust Storm)
RDAT	RDAT can exfiltrate data gathered from the infected system via the established Exchange Web Services API C2 channel.(Citation: Unit42 RDAT July 2020)
Gamaredon Group	A Gamaredon Group file stealer can transfer collected files to a hardcoded C2 server.(Citation: Palo Alto Gamaredon Feb 2017)
LitePower	LitePower can send collected data, including screenshots, over its C2 channel.(Citation: Kaspersky WIRTE November 2021)
Spark	Spark has exfiltrated data over the C2 channel.(Citation: Unit42 Molerat Mar 2020)
ADVSTORESHELL	ADVSTORESHELL exfiltrates data over the same channel used for C2.(Citation: ESET Sednit Part 2)
Operation Wocao	Operation Wocao has used the Xserver backdoor to exfiltrate data.(Citation: FoxIT Wocao December 2019)
Goopy	Goopy has the ability to exfiltrate data over the Microsoft Outlook C2 channel.(Citation: Cybereason Cobalt Kitty 2017)
CallMe	CallMe exfiltrates data to its C2 server over the same protocol as C2 communications.(Citation: Scarlet Mimic Jan 2016)
GoldMax	GoldMax can exfiltrate files over the existing C2 channel.(Citation: MSTIC NOBELIUM Mar 2021)(Citation: FireEye SUNSHUTTLE Mar 2021)
MuddyWater	MuddyWater has used C2 infrastructure to receive exfiltrated data.(Citation: Reaqta MuddyWater November 2017)
Stealth Falcon	After data is collected by Stealth Falcon malware, it is exfiltrated over the existing C2 channel.(Citation: Citizen Lab Stealth Falcon May 2016)
Ebury	Ebury exfiltrates a list of outbound and inbound SSH sessions using OpenSSH's `known_host` files and `wtmp` records. Ebury can exfiltrate SSH credentials through custom DNS queries or use the command `Xcat` to send the process's ssh session's credentials to the C2 server.(Citation: ESET Windigo Mar 2014)(Citation: ESET Ebury May 2024)
ZLib	ZLib has sent data and files from a compromised host to its C2 servers.(Citation: Cylance Dust Storm)
Dyre	Dyre has the ability to send information staged on a compromised host externally to C2.(Citation: Malwarebytes Dyreza November 2015)
RotaJakiro	RotaJakiro sends device and other collected data back to the C2 using the established C2 channels over TCP. (Citation: RotaJakiro 2021 netlab360 analysis)
CURIUM	CURIUM has used IMAP and SMTPS for exfiltration via tools such as IMAPLoader.(Citation: PWC Yellow Liderc 2023)
GrimAgent	GrimAgent has sent data related to a compromise host over its C2 channel.(Citation: Group IB GrimAgent July 2021)
BADHATCH	BADHATCH can exfiltrate data over the C2 channel.(Citation: Gigamon BADHATCH Jul 2019)(Citation: BitDefender BADHATCH Mar 2021)
PingPull	PingPull has the ability to exfiltrate stolen victim data through its C2 channel.(Citation: Unit 42 PingPull Jun 2022)
Crutch	Crutch can exfiltrate data over the primary C2 channel (Dropbox HTTP API).(Citation: ESET Crutch December 2020)
OopsIE	OopsIE can upload files from the victim's machine to its C2 server.(Citation: Unit 42 OopsIE! Feb 2018)

Контрмера	Описание
Контрмеры
Network Intrusion Prevention	Use intrusion detection signatures to block traffic at network boundaries.
Exfiltration Over Command and Control Channel Mitigation	Mitigations for command and control apply. Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool command and control signatures over time or construct protocols in such a way to avoid detection by common defensive tools. (Citation: University of Birmingham C2)
Data Loss Prevention	Use a data loss prevention (DLP) strategy to categorize sensitive data, identify data formats indicative of personal identifiable information (PII), and restrict exfiltration of sensitive data.(Citation: PurpleSec Data Loss Prevention)

Обнаружение

Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2)

Эксфильтрация через канал управления

Примеры процедур

Контрмеры

Обнаружение

Ссылки