Exfiltration attempt via network utility

Classification:

attack

Tactic:

TA0010-exfiltration

Technique:

T1048-exfiltration-over-alternative-protocol

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Goal

Detect data exfiltration using a web utility such as cURL or wget.

Strategy

Some network utilities support arguments for sending file contents in a network request. Attackers use this functionality to exfiltrate data of sensitive files. Multiple files may be packaged into a file archive before being exfiltrated.

Triage and response

  1. Inspect the process arguments. Identify the content being sent and the destination URL.
  2. Determine if this activity is expected.
  3. If the network request is not expected, contain the host or container and roll back to a known good configuration. Initiate the incident response process.
  4. Review related signals for other suspicious activity.

Requires Agent version 7.28 or greater