Goal

Detect data exfiltration using a web utility such as cURL or wget.

Strategy

Some network utilities support arguments for sending file contents in a network request. Attackers use this functionality to exfiltrate data of sensitive files. Multiple files may be packaged into a file archive before being exfiltrated.

Triage and response

1. Inspect the process arguments. Identify the content being sent and the destination URL.
2. Determine if this activity is expected.
3. If the network request is not expected, contain the host or container and roll back to a known good configuration. Initiate the incident response process.
4. Review related signals for other suspicious activity.

Requires Agent version 7.28 or greater