T1020 Automated Exfiltration
Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.(Citation: ESET Gamaredon June 2020) When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1041)…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Restore Public AWS RDS Instancehightest · aws
- Modification or Deletion of an AWS RDS Clusterhighexperimental · aws
- AWS RDS Master Password Changemediumtest · aws
- Github Fork Private Repositories Setting Enabled/Clearedmediumtest · github
- Github Repository/Organization Transferredmediumtest · github
- PowerShell Script With File Hostname Resolving Capabilitiesmediumtest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.