search
githubEdit

Data Theft (MITRE ATT&CK: T1041, T1071)

Note: Sometimes, you may have to customise the queries to your environment. Also, queries will only work if the data is available.

hashtag
Data Theft (MITRE ATT&CK: T1041, T1071)

Overview:

Data theft involves the exfiltration of sensitive information from compromised systems. Attackers often use network-based techniques or built-in tools to exfiltrate data to external servers.

25 Example Queries for Data Theft Detection:

  1. Monitor Data Exfiltration via FTP (Port 21) FTP is commonly used for data exfiltration to external servers.

DeviceNetworkEvents | where RemotePort == 21 and ActionType == "ConnectionSuccess" | summarize count() by DeviceName, RemoteIP

  1. Detect HTTP POST Requests to External Servers Data exfiltration often occurs via HTTP POST requests.

DeviceNetworkEvents | where HttpMethod == "POST" and RemoteIP not in (expected_ips) | summarize count() by DeviceName, RemoteIP, HttpMethod

  1. Track Unusual Data Transfers Over SMB (File Copying) Data may be exfiltrated over SMB by copying sensitive files.

DeviceNetworkEvents | where RemotePort == 445 and ActionType == "FileCopy" | summarize count() by DeviceName, RemoteIP, FileShare

  1. Monitor Use of Cloud Storage Services for Data Exfiltration Attackers may use cloud services (e.g., Dropbox, Google Drive) to exfiltrate data.

DeviceNetworkEvents | where RemoteUrl contains "dropbox.com" or RemoteUrl contains "drive.google.com" | summarize count() by DeviceName, RemoteUrl

  1. Detect Use of PowerShell for File Uploads (Invoke-WebRequest) PowerShell scripts may use Invoke-WebRequest to exfiltrate data.

DeviceProcessEvents | where FileName == "powershell.exe" and ProcessCommandLine has "Invoke-WebRequest" | summarize count() by DeviceName, InitiatingProcessAccountName, ProcessCommandLine

  1. Track Data Exfiltration Attempts Over DNS (DNS Tunneling) DNS tunneling is used to exfiltrate data over DNS queries.

DeviceNetworkEvents | where DnsQueryType == "TXT" and RemoteIP not in (expected_ips) | summarize count() by DeviceName, RemoteIP

  1. Monitor Outbound Traffic to Suspicious IPs (External C2) Outbound traffic to suspicious or external IP addresses may indicate data exfiltration.

  1. Detect Large Data Transfers Over Non-Standard Ports Unusually large data transfers over non-standard ports may indicate exfiltration.

  1. Monitor Use of File Transfer Protocols (SFTP, SCP) for Data Exfiltration SFTP and SCP are commonly used for secure file transfers and may be abused for data exfiltration.

  1. Track Data Exfiltration via Email (Suspicious Attachments) Data may be exfiltrated by sending sensitive files as email attachments.

  1. Detect Data Transfers via HTTP PUT Requests HTTP PUT requests may be used to upload data to external servers.

  1. Monitor Large Data Transfers Over RDP (Clipboard Sharing) RDP clipboard sharing may be used to exfiltrate data during remote sessions.

  1. Track Use of USB Storage Devices for Data Exfiltration USB storage devices may be used to copy sensitive data for exfiltration.

  1. Detect Use of Encrypted Channels for Data Exfiltration (TLS/SSL) Encrypted communication channels may be used to hide data exfiltration.

  1. Monitor File Transfers to External FTP Servers FTP servers may be used to store exfiltrated data.

  1. Detect Use of OneDrive for Data Exfiltration OneDrive may be used to store sensitive files outside of the corporate network.

  1. Track Use of Unapproved Cloud Storage Providers (e.g., Box) Data may be exfiltrated to unapproved cloud storage services like Box.

  1. Monitor Data Exfiltration via VPN Services VPN services may be used to hide data exfiltration activities.

  1. Detect Large Data Transfers Over ICMP (Ping Flooding) ICMP packets can be used to exfiltrate data in a covert manner.

  1. Track the Use of Data Compression Tools (e.g., 7-Zip) for Exfiltration Attackers may compress files before exfiltrating them to reduce detection.

  1. Monitor Use of Secure Shell (SSH) for Data Exfiltration SSH connections may be used to exfiltrate data in a secure manner.

  1. Detect Use of WebDAV for Data Exfiltration WebDAV is a protocol that may be used for file transfer and data exfiltration.

  1. Track Use of File Transfer Applications (e.g., FileZilla) File transfer applications may be used to exfiltrate data.

  1. Monitor for Unusual Data Exfiltration via Secure File Transfer (HTTPS) HTTPS may be used to hide data exfiltration in encrypted traffic.

  1. Detect Use of Unapproved Email Clients for Data Exfiltration Unapproved email clients may be used to send sensitive data externally.

PreviousLateral Movement (MITRE ATT&CK: T1076, T1021)NextDetecting CommandLine Executions (MITRE ATT&CK: T1059)

Last updated