| ID | Name |
|---|---|
| T1567.001 | Exfiltration to Code Repository |
| T1567.002 | Exfiltration to Cloud Storage |
Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet.
Examples of cloud storage services include Dropbox and Google Docs. Exfiltration to these cloud storage services can provide a significant amount of cover to the adversary if hosts within the network are already communicating with the service.
Angreifer können Daten zu einem Cloud-Speicherdienst exfiltrieren, anstatt über ihren primären Befehls- und Kontrollkanal. Cloud-Speicherdienste ermöglichen das Speichern, Bearbeiten und Abrufen von Daten von einem entfernten Cloud-Speicher-Server über das Internet.
Beispiele für Cloud-Speicherdienste sind Dropbox und Google Docs. Die Exfiltration zu diesen Cloud-Speicherdiensten kann dem Angreifer eine erhebliche Deckung bieten, wenn Hosts innerhalb des Netzwerks bereits mit dem Dienst kommunizieren.
Les adversaires peuvent exfiltrer des données vers un service de stockage en nuage plutôt que sur leur canal principal de commande et de contrôle. Les services de stockage en nuage permettent de stocker, de modifier et de récupérer des données à partir d'un serveur de stockage en nuage distant sur Internet.
Dropbox et Google Docs sont des exemples de services de stockage en nuage. L'exfiltration vers ces services de stockage en nuage peut fournir une couverture importante à l'adversaire si les hôtes du réseau communiquent déjà avec le service.
Gli avversari possono esfiltrare i dati su un servizio di cloud storage piuttosto che sul loro canale primario di comando e controllo. I servizi di cloud storage permettono di archiviare, modificare e recuperare dati da un server remoto di cloud storage su Internet.
Esempi di servizi di cloud storage includono Dropbox e Google Docs. L'esfiltrazione a questi servizi di cloud storage può fornire una quantità significativa di copertura all'avversario se gli host all'interno della rete stanno già comunicando con il servizio.
| ID | Name | Description |
|---|---|---|
| S0635 | BoomBox |
BoomBox can upload data to dedicated per-victim folders in Dropbox.[1] |
| S0651 | BoxCaon |
BoxCaon has the capability to download folders' contents on the system and upload the results back to its Dropbox drive.[2] |
| G0114 | Chimera |
Chimera has exfiltrated stolen data to OneDrive accounts.[3] |
| S0538 | Crutch | |
| S0363 | Empire | |
| G0046 | FIN7 |
FIN7 has exfiltrated stolen data to the MEGA file sharing site.[6] |
| G0125 | HAFNIUM |
HAFNIUM has exfiltrated data to file sharing sites, including MEGA.[7] |
| S0037 | HAMMERTOSS |
HAMMERTOSS exfiltrates data by uploading it to accounts created by the actors on Web cloud storage providers for the adversaries to retrieve later.[8] |
| G0065 | Leviathan |
Leviathan has used an uploader known as LUNCHMONEY that can exfiltrate files to Dropbox.[9][10] |
| S0340 | Octopus | |
| S0629 | RainyDay |
RainyDay can use a file exfiltration tool to upload specific files to Dropbox.[12] |
| G0010 | Turla |
Turla has used WebDAV to upload stolen USB files to a cloud drive.[13] Turla has also exfiltrated stolen files to OneDrive and 4shared.[14] |
| G0128 | ZIRCONIUM |
| ID | Mitigation | Description |
|---|---|---|
| M1021 | Restrict Web-Based Content |
Web proxies can be used to enforce an external network communication policy that prevents use of unauthorized external services. |
| ID | Data Source | Data Component |
|---|---|---|
| DS0017 | Command | Command Execution |
| DS0022 | File | File Access |
| DS0029 | Network Traffic | Network Traffic Content |
| Network Traffic Flow |
Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server) to known cloud storage services. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. User behavior monitoring may help to detect abnormal patterns of activity.
Analysieren Sie die Netzwerkdaten auf ungewöhnliche Datenströme (z.B. ein Client, der deutlich mehr Daten sendet als er von einem Server empfängt) zu bekannten Cloud-Speicherdiensten. Prozesse, die das Netzwerk nutzen, die normalerweise keine Netzwerkkommunikation haben oder noch nie gesehen wurden, sind verdächtig. Die Überwachung des Benutzerverhaltens kann helfen, abnormale Aktivitätsmuster zu erkennen.
Analysez les données du réseau pour détecter les flux de données inhabituels (par exemple, un client qui envoie beaucoup plus de données qu'il n'en reçoit d'un serveur) vers des services de stockage en nuage connus. Les processus utilisant le réseau qui n'ont pas de communication réseau normale ou qui n'ont jamais été vus auparavant sont suspects. La surveillance du comportement des utilisateurs peut aider à détecter des modèles d'activité anormaux.
Analizzi i dati di rete alla ricerca di flussi di dati insoliti (ad esempio, un cliente che invia molti più dati di quanti ne riceva da un server) verso servizi di cloud storage conosciuti. I processi che utilizzano la rete che normalmente non hanno comunicazioni in rete o che non sono mai stati visti prima sono sospetti. Il monitoraggio del comportamento degli utenti può aiutare a rilevare modelli di attività anormali.