Hello and welcome to another
application of the modern tech
framework discussion today
we are looking at automated
exfiltration and so
our objectives are as follows.
We're going to describe for you what
automated exfiltration is.
Perminder some mitigation
techniques, detection techniques,
and will be squeezing some tool
talk into this space
here.
So with that, let's go ahead and
jump in to what automated
exfiltration is.
And so, as the name suggests,
this is when threat actors attempt
to take data through automated
processing or scripting after
everything is gathered during
the collection phase.
This can be done through
exfiltration, over command and
control and over alternative
protocols.
And so a few tools to
keep in mind and some of their
capabilities.
Rover, which for
me sounds a lot like the game red
rover that kids used to play, is
when automatically searches for
files on local drag based on
predefined lists of file extensions
and sends them on over to
the command and control server every
60 minutes.
Tiny typhoon or typhoon.
It searches for documents and when
one is found with a matching
extension, it uploads it to
the command and control server.
USB Stihler is automatically
exhilarates collected files via
removable media when an infected
device is connected to a second
victim. And so this is essentially
when your initial media gets
infected for every thing you plug it
into. After that, it starts to steal
data. Some of the common things that
we see here are the command and
control servers being used
in these techniques.
Now, mitigation here is
still limited to end user
awareness training because
this reduces the overall risk of
compromised.
You may be able to get some of
this blocked using something like
intrusion prevention
and looking for common command and
control signatures and data uploads.
There also may be some discussions
that could be had on using
firewall protections and other
data blocking activities to ensure
that files are not precariously
uploaded or out of
the network.
Now, that would just involve some
data classification and additional
protections put in place.
Detection techniques can include
monitoring process, file access
patterns and network behavior.
Again, what is normal for
the environment?
What is not normal baseline in that?
And then being able to proactively
address instances where
it is outside of the norm.
Now with that, let's do a quick
check on learning.
True or false?
Automated exfiltration is when a
threat actor automatically removes
data from the victim network
through things like scripting.
So if you need additional time to
consider this question, please pause
the video. So automated exfiltration
is when a threat actor automatically
removes data from a victim network
through things like scripting.
So with these
points in mind, this is a true
statement.
Automated exfiltration is
essentially when threat actors tried
to use tools or automatic means
to remove data.
Now let's jump into the summary
for today's discussion.
As we discussed, we looked at
automated exfiltration from
a scripting or tool standpoint,
using those things to essentially
pull data as it's identified
and pushed to a command and control
server.
We describe some mitigation
techniques and we looked at
detection techniques
as well, both of those still
being in the realm of behavioral
analysis based learning system
activity.
And any time it's outside of the
norm, we evaluated
that activity mitigation techniques
still sticking around in user
awareness training.
And there may be some credence here
for network intrusion prevention and
additional data protections.
But again, that
end user awareness training is going
to be the biggest mitigating factor.
So with that in mind, I want to
thank you for your time today, and
I look forward to seeing you again
soon.