Automated Exfiltration

From enterprise
Jump to: navigation, search
Automated Exfiltration
Technique
ID T1020
Tactic Exfiltration
Platform Windows Server 2003, Windows Server 2008, Windows Server 2012, Windows XP, Windows 7, Windows 8, Windows Server 2003 R2, Windows Server 2008 R2, Windows Server 2012 R2, Windows Vista, Windows 8.1, Linux, Windows 10, MacOS, OS X
Data Sources File monitoring, Process monitoring, Process use of network
Requires Network Yes

Data, such as sensitive documents, may be exfiltrated through the use of automated processing or Scripting after being gathered during Collection.

When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over Command and Control Channel and Exfiltration Over Alternative Protocol.

Examples

  • CosmicDuke exfiltrates collected files automatically over FTP to remote servers.1
  • Rover automatically searches for files on local drives based on a predefined list of file extensions and sends them to the command and control server every 60 minutes. Rover also automatically sends keylogger files and screenshots to the C2 server on a regular timeframe.2
  • When a document is found matching one of the extensions in the configuration, TINYTYPHON uploads it to the C2 server.3
  • USBStealer automatically exfiltrates collected files via removable media when an infected device is connected to the second victim after receiving commands from the first victim.4

Mitigation

Identify unnecessary system utilities, scripts, or potentially malicious software that may be used to transfer data outside of a network, and audit and/or block them by using whitelisting5 tools, like AppLocker,67 or Software Restriction Policies8 where appropriate.9

Detection

Monitor process file access patterns and network behavior. Unrecognized processes or scripts that appear to be traversing file systems and sending network traffic may be suspicious.