T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
Subtécnica de T1048 Exfiltration Over Alternative Protocol
Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.(Citation: copy_cmd_cisco) Adversaries may opt to obfuscate this data, without the use of encryption, within network protocols that are natively…
Quién la usa · con noticias en Jábega
Reglas Sigma para cazarla
- Suspicious WebDav Client Execution Via Rundll32.EXEhightest · windows
- Data Exfiltration with Wgetmediumtest · linux
- PowerShell ICMP Exfiltrationmediumtest · windows
- Suspicious DNS Query with B64 Encoded Stringmediumtest · dns
- Suspicious Outbound SMTP Connectionsmediumtest · windows
- WebDav Client Execution Via Rundll32.EXEmediumtest · windows
- Python WebServer Execution - Linuxmediumexperimental · linux
Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.