Exfiltration attempt via network utility
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。
Goal
Detect data exfiltration using a web utility such as cURL or wget.
Strategy
Some network utilities support arguments for sending file contents in a network request. Attackers use this functionality to exfiltrate data of sensitive files. Multiple files may be packaged into a file archive before being exfiltrated.
Triage and response
- Inspect the process arguments. Identify the content being sent and the destination URL.
- Determine if this activity is expected.
- If the network request is not expected, contain the host or container and roll back to a known good configuration. Initiate the incident response process.
- Review related signals for other suspicious activity.
Requires Agent version 7.28 or greater
