Exfiltration attempt via network utility

Classification:

attack

Tactic:

TA0010-exfiltration

Technique:

T1048-exfiltration-over-alternative-protocol

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

What happened

{{ @process.comm }} was executed with arguments indicating data exfiltration.

Goal

Detect data exfiltration using a web utility such as cURL or wget.

Strategy

Some network utilities support arguments for sending file contents in a network request. Attackers use this functionality to exfiltrate data of sensitive files. Multiple files may be packaged into a file archive before being exfiltrated.

Triage and response

  1. Inspect the process arguments. Identify the content being sent and the destination URL.
  2. Determine if this activity is expected.
  3. If the network request is not expected, contain the host or container and roll back to a known good configuration. Initiate the incident response process.
  4. Review related signals for other suspicious activity.

Requires Agent version 7.28 or greater