| ID | Name |
|---|---|
| T1020.001 | Traffic Duplication |
Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.[1]
When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over C2 Channel and Exfiltration Over Alternative Protocol.
| ID | Name | Description |
|---|---|---|
| C0046 | ArcaneDoor |
ArcaneDoor included scripted exfiltration of collected data.[2] |
| S0438 | Attor |
Attor has a file uploader plugin that automatically exfiltrates the collected data and log files to the C2 server.[3] |
| S0050 | CosmicDuke |
CosmicDuke exfiltrates collected files automatically over FTP to remote servers.[4] |
| S0538 | Crutch |
Crutch has automatically exfiltrated stolen files to Dropbox.[5] |
| S0600 | Doki |
Doki has used a script that gathers information from a hardcoded list of IP addresses and uploads to an Ngrok URL.[6] |
| S0377 | Ebury |
If credentials are not collected for two weeks, Ebury encrypts the credentials using a public key and sends them via UDP to an IP address located in the DNS TXT record.[7][8] |
| S0363 | Empire |
Empire has the ability to automatically send collected data back to the threat actors' C2.[9] |
| C0001 | Frankenstein |
During Frankenstein, the threat actors collected information via Empire, which was automatically sent back to the adversary's C2.[9] |
| G0047 | Gamaredon Group |
Gamaredon Group has used modules that automatically upload gathered documents to the C2 server.[1] |
| S1211 | Hannotog | |
| G0004 | Ke3chang |
Ke3chang has performed frequent and scheduled data exfiltration from compromised networks.[11] |
| S0395 | LightNeuron |
LightNeuron can be configured to automatically exfiltrate files under a specified directory.[12] |
| S0409 | Machete |
Machete’s collected files are exfiltrated automatically to remote servers.[13] |
| S1017 | OutSteel |
OutSteel can automatically upload collected files to its C2 server.[14] |
| S0643 | Peppy |
Peppy has the ability to automatically exfiltrate files and keylogs.[15] |
| S1148 | Raccoon Stealer |
Raccoon Stealer will automatically collect and exfiltrate data identified in received configuration files from command and control nodes.[16][17][18] |
| G1039 | RedCurl | |
| S0090 | Rover |
Rover automatically searches for files on local drives based on a predefined list of file extensions and sends them to the command and control server every 60 minutes. Rover also automatically sends keylogger files and screenshots to the C2 server on a regular timeframe.[21] |
| S0445 | ShimRatReporter |
ShimRatReporter sent collected system and network information compiled into a report to an adversary-controlled C2.[22] |
| G0121 | Sidewinder |
Sidewinder has configured tools to automatically send collected files to attacker controlled servers.[23] |
| S1166 | Solar |
Solar can automatically exfitrate files from compromised systems.[24] |
| S1183 | StrelaStealer |
StrelaStealer automatically sends gathered email credentials following collection to command and control servers via HTTP POST.[25][26] |
| S0491 | StrongPity |
StrongPity can automatically exfiltrate collected documents to the C2 server.[27][28] |
| S0467 | TajMahal |
TajMahal has the ability to manage an automated queue of egress files and commands sent to its C2.[29] |
| S0131 | TINYTYPHON |
When a document is found matching one of the extensions in the configuration, TINYTYPHON uploads it to the C2 server.[30] |
| G0081 | Tropic Trooper |
Tropic Trooper has used a copy function to automatically exfiltrate sensitive data from air-gapped systems using USB storage.[31] |
| S0136 | USBStealer |
USBStealer automatically exfiltrates collected files via removable media when an infected device connects to an air-gapped victim machine after initially being connected to an internet-enabled victim machine. [32] |
| G1035 | Winter Vivern |
Winter Vivern delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP.[33] |
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0017 | Command | Command Execution |
Monitor execution of exfiltration-related commands such as scp, rsync, curl, ftp, wget, command-line utilities used to archive and move data (tar, zip, 7z), suspicious execution of scripts performing batch file transfers, or unusual usage of PowerShell, Bash, or Python for bulk file movement. Analytic 1 - Detecting Automated File Exfiltration Commands
|
| DS0022 | File | File Access |
Monitor for abnormal access to files (i.e. .pdf, .docx, .jpg, etc.), especially sensitive documents, through the use of automated processing after being gathered during Collection. Analytic 1 - Detecting File Access Before Automated Exfiltration
|
| DS0029 | Network Traffic | Network Connection Creation |
Monitor for newly constructed network connections associated with processes performing collection activity, especially those involving abnormal/untrusted hosts. Analytic 1 - Detecting Automated Exfiltration via Network
|
| Network Traffic Content |
Monitor network traffic content for evidence of data exfiltration, such as gratuitous or anomalous outbound traffic containing collected data. Consider correlation with process monitoring and command lines associated with collection and exfiltration. |
||
| Network Traffic Flow |
Monitor and analyze network flows associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, or gratuitous or anomalous traffic patterns). Consider analyzing newly constructed network connections that are sent or received by untrusted hosts, unexpected hardware devices, or other uncommon data flows. |
||
| DS0012 | Script | Script Execution |
Monitor for any attempts to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent. Analytic 1 - Detecting Automated Script Execution for Exfiltration
|