Analytics Story: Data Exfiltration

Description

Data exfiltration refers to the unauthorized transfer or extraction of sensitive or valuable data from a compromised system or network during a cyber attack. It is a critical phase in many targeted attacks, where adversaries aim to steal confidential information, such as intellectual property, financial records, personal data, or trade secrets.

Why it matters

This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) leveraged by adversaries to exfiltrate data from your environments. Exfiltration comes in many flavors and its done differently on every environment. Adversaries can collect data over encrypted or non-encrypted channels. They can utilise Command And Control channels that are already in place to exfiltrate data. They can use both standard data transfer protocols such as FTP, SCP, etc to exfiltrate data. Or they can use non-standard protocols such as DNS, ICMP, etc with specially crafted fields to try and circumvent security technologies in place. Techniques for getting data out of a target network typically include transferring it over their command and control channel or an alternate channel and may also include putting size limits on the transmission. In context of the cloud, this refers to the unauthorized transfer or extraction of sensitive data from cloud-based systems or services. It involves the compromise of cloud infrastructure or accounts to gain access to valuable information stored in the cloud environment. Attackers may employ various techniques, such as exploiting vulnerabilities, stealing login credentials, or using malicious code to exfiltrate data from cloud repositories or services without detection.

1| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count values(All_Risk.risk_message) as risk_message  from datamodel=Risk.All_Risk where All_Risk.annotations.mitre_attack.mitre_tactic = "collection" OR All_Risk.annotations.mitre_attack.mitre_tactic = "exfiltration" source = *AWS*  by All_Risk.risk_object | `drop_dm_object_name(All_Risk)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where source_count >= 2 and mitre_tactic_id_count>=2 | `aws_s3_exfiltration_behavior_identified_filter`

Detections

Name ▲▼ Technique ▲▼ Type ▲▼
AWS AMI Attribute Modification for Exfiltration Transfer Data to Cloud Account TTP
AWS Disable Bucket Versioning Inhibit System Recovery Anomaly
AWS EC2 Snapshot Shared Externally Transfer Data to Cloud Account TTP
AWS Exfiltration via Anomalous GetObject API Activity Automated Collection Anomaly
AWS Exfiltration via Batch Service Automated Collection TTP
AWS Exfiltration via Bucket Replication Transfer Data to Cloud Account TTP
AWS Exfiltration via DataSync Task Automated Collection TTP
AWS Exfiltration via EC2 Snapshot Transfer Data to Cloud Account TTP
Gdrive suspicious file sharing Phishing Hunting
O365 Application Available To Other Tenants Additional Cloud Roles, Account Manipulation TTP
O365 DLP Rule Triggered Exfiltration Over Alternative Protocol, Exfiltration Over Web Service Anomaly
O365 Email Access By Security Administrator Exfiltration Over Web Service, Email Collection, Remote Email Collection TTP
O365 PST export alert Email Collection TTP
O365 Suspicious Admin Email Forwarding Email Forwarding Rule, Email Collection Anomaly
O365 Suspicious User Email Forwarding Email Forwarding Rule, Email Collection Anomaly
Detect Certipy File Modifications Steal or Forge Authentication Certificates, Archive Collected Data TTP
DNS Exfiltration Using Nslookup App Exfiltration Over Alternative Protocol TTP
Excessive Usage of NSLOOKUP App Exfiltration Over Alternative Protocol Anomaly
Linux Curl Upload File Ingress Tool Transfer TTP
Mailsniper Invoke functions Email Collection, Local Email Collection TTP
Detect DGA domains using pretrained model in DSDL Domain Generation Algorithms Anomaly
Detect SNICat SNI Exfiltration Exfiltration Over C2 Channel TTP
High Volume of Bytes Out to Url Exfiltration Over Web Service Anomaly
Multiple Archive Files Http Post Traffic Exfiltration Over Unencrypted Non-C2 Protocol, Exfiltration Over Alternative Protocol TTP
Plain HTTP POST Exfiltrated Data Exfiltration Over Unencrypted Non-C2 Protocol, Exfiltration Over Alternative Protocol TTP

Data Sources

Name ▲▼ Platform ▲▼ Sourcetype ▲▼ Source ▲▼
AWS CloudTrail CreateSnapshot AWS icon AWS aws:cloudtrail aws_cloudtrail
AWS CloudTrail CreateTask AWS icon AWS aws:cloudtrail aws_cloudtrail
AWS CloudTrail DeleteSnapshot AWS icon AWS aws:cloudtrail aws_cloudtrail
AWS CloudTrail GetObject AWS icon AWS aws:cloudtrail aws_cloudtrail
AWS CloudTrail JobCreated AWS icon AWS aws:cloudtrail aws_cloudtrail
AWS CloudTrail ModifyImageAttribute AWS icon AWS aws:cloudtrail aws_cloudtrail
AWS CloudTrail ModifySnapshotAttribute AWS icon AWS aws:cloudtrail aws_cloudtrail
AWS CloudTrail PutBucketReplication AWS icon AWS aws:cloudtrail aws_cloudtrail
AWS CloudTrail PutBucketVersioning AWS icon AWS aws:cloudtrail aws_cloudtrail
CrowdStrike ProcessRollup2 N/A crowdstrike:events:sensor crowdstrike
Nginx Access N/A nginx:plus:kv /var/log/nginx/access.log
O365 N/A o365:management:activity o365
Powershell Script Block Logging 4104 Windows icon Windows xmlwineventlog XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
Splunk Stream HTTP Splunk icon Splunk stream:http stream:http
Sysmon EventID 1 Windows icon Windows xmlwineventlog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Sysmon EventID 11 Windows icon Windows xmlwineventlog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Sysmon for Linux EventID 1 Linux icon Linux sysmon:linux Syslog:Linux-Sysmon/Operational
Windows Event Log Security 4688 Windows icon Windows xmlwineventlog XmlWinEventLog:Security

References


Source: GitHub | Version: 2