attack.t1048.003

Data Exfiltration with Wget

Aug 12, 2024 · attack.exfiltration attack.t1048.003 ·

Detects attempts to post the file with the usage of wget utility. The adversary can bypass the permission restriction with the misconfigured sudo permission for wget utility which could allow them to read files like /etc/shadow.

Powershell Exfiltration Over SMTP

Aug 12, 2024 · attack.exfiltration attack.t1048.003 ·

Share on:

Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.

PowerShell ICMP Exfiltration

Aug 12, 2024 · attack.exfiltration attack.t1048.003 ·

Share on:

Detects Exfiltration Over Alternative Protocol - ICMP. Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.

Suspicious DNS Query with B64 Encoded String

Aug 12, 2024 · attack.exfiltration attack.t1048.003 attack.command-and-control attack.t1071.004 ·

Share on:

Detects suspicious DNS queries using base64 encoding

Suspicious Outbound SMTP Connections

Aug 12, 2024 · attack.exfiltration attack.t1048.003 ·

Share on:

Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.

Suspicious WebDav Client Execution Via Rundll32.EXE

Aug 12, 2024 · attack.exfiltration attack.t1048.003 cve.2023-23397 ·

Share on:

Detects "svchost.exe" spawning "rundll32.exe" with command arguments like C:\windows\system32\davclnt.dll,DavSetCookie. This could be an indicator of exfiltration or use of WebDav to launch code (hosted on WebDav Server) or potentially a sign of exploitation of CVE-2023-23397

WebDav Client Execution Via Rundll32.EXE

Aug 12, 2024 · attack.exfiltration attack.t1048.003 ·

Share on:

Detects "svchost.exe" spawning "rundll32.exe" with command arguments like "C:\windows\system32\davclnt.dll,DavSetCookie". This could be an indicator of exfiltration or use of WebDav to launch code (hosted on a WebDav server).

WebDav Put Request

Aug 12, 2024 · attack.exfiltration attack.t1048.003 ·

Share on:

A General detection for WebDav user-agent being used to PUT files on a WebDav network share. This could be an indicator of exfiltration.

High DNS Bytes Out

Apr 21, 2023 · attack.exfiltration attack.t1048.003 ·

Share on:

High DNS queries bytes amount from host per short period of time

High DNS Bytes Out - Firewall

Apr 21, 2023 · attack.exfiltration attack.t1048.003 ·

Share on:

High DNS queries bytes amount from host per short period of time

High DNS Requests Rate

Apr 21, 2023 · attack.exfiltration attack.t1048.003 attack.command_and_control attack.t1071.004 ·

Share on:

High DNS requests amount from host per short period of time

High DNS Requests Rate - Firewall

Apr 21, 2023 · attack.exfiltration attack.t1048.003 attack.command_and_control attack.t1071.004 ·

Share on:

High DNS requests amount from host per short period of time

High NULL Records Requests Rate

Apr 21, 2023 · attack.exfiltration attack.t1048.003 attack.command_and_control attack.t1071.004 ·

Share on:

Extremely high rate of NULL record type DNS requests from host per short period of time. Possible result of iodine tool execution

High TXT Records Requests Rate

Apr 21, 2023 · attack.exfiltration attack.t1048.003 attack.command_and_control attack.t1071.004 ·

Share on:

Extremely high rate of TXT record type DNS requests from host per short period of time. Possible result of Do-exfiltration tool execution

Possible DNS Tunneling

Apr 21, 2023 · attack.command_and_control attack.t1071.004 attack.exfiltration attack.t1048.003 ·

Share on:

Normally, DNS logs contain a limited amount of different dns queries for a single domain. This rule detects a high amount of queries for a single domain, which can be an indicator that DNS is used to transfer data.