Exfiltration attempt via network utility

Classification:

attack

Tactic:

TA0010-exfiltration

Technique:

T1048-exfiltration-over-alternative-protocol

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Goal

Detect data exfiltration using a web utility such as cURL or wget.

Strategy

Some network utilities support arguments for sending file contents in a network request. Attackers use this functionality to exfiltrate data of sensitive files. Multiple files may be packaged into a file archive before being exfiltrated.

Triage and response

  1. Inspect the process arguments. Identify the content being sent and the destination URL.
  2. Determine if this activity is expected.
  3. If the network request is not expected, contain the host or container and roll back to a known good configuration. Initiate the incident response process.
  4. Review related signals for other suspicious activity.

Requires Agent version 7.28 or greater