MITRE ATT&CK Enterprise techniques whose primary tactic is Exfiltration: detection with open-source tooling and cyber range exercises.
Detecting T1011 Exfiltration Over Other Network Medium on Linux, macOS and Windows, using telemetry such as Network Connection Creation, Process Creation and Network Traffic Flow. Covers its 1 sub-technique, the ATT&CK mitigations Disable or Remove Feature or Program and Operating System Configuration, and how to rehearse the detection in a cyber range.
Detecting T1020 Automated Exfiltration on Linux, macOS, Network Devices and Windows, using telemetry such as Network Connection Creation, Process Creation and Scheduled Job Creation. Covers its 1 sub-technique and how to rehearse the detection in a cyber range.
Detecting T1029 Scheduled Transfer on Linux, macOS and Windows, using telemetry such as Network Connection Creation, Process Creation and Network Traffic Flow. Covers the ATT&CK mitigation Network Intrusion Prevention and how to rehearse the detection in a cyber range.
Detecting T1030 Data Transfer Size Limits on Linux, macOS, Windows and ESXi, using telemetry such as Network Connection Creation and Network Traffic Flow. Covers the ATT&CK mitigation Network Intrusion Prevention and how to rehearse the detection in a cyber range.
Detecting T1041 Exfiltration Over C2 Channel on ESXi, Linux, macOS and Windows, using telemetry such as Network Connection Creation, Process Creation and Network Traffic Flow. Covers the ATT&CK mitigations Data Loss Prevention and Network Intrusion Prevention and how to rehearse the detection in a cyber range.
Detecting T1048 Exfiltration Over Alternative Protocol on ESXi, IaaS, Linux and macOS and other platforms, using telemetry such as Process Creation, Network Connection Creation and Network Traffic Flow. Covers its 3 sub-techniques, the ATT&CK mitigations Data Loss Prevention and Network Intrusion Prevention, and how to rehearse the detection in a cyber range.
Detecting T1052 Exfiltration Over Physical Medium on Linux, macOS and Windows, using telemetry such as Process Creation, File Access and Command Execution. Covers its 1 sub-technique, the ATT&CK mitigations Data Loss Prevention and Disable or Remove Feature or Program, and how to rehearse the detection in a cyber range.
Detecting T1537 Transfer Data to Cloud Account on IaaS, Office Suite and SaaS, using telemetry such as Network Traffic Content, Application Log Content and Snapshot Metadata. Covers the ATT&CK mitigations Data Loss Prevention and User Account Management and how to rehearse the detection in a cyber range.
Detecting T1567 Exfiltration Over Web Service on ESXi, Linux, macOS and Office Suite and other platforms, using telemetry such as Process Creation, Network Connection Creation and Network Traffic Flow. Covers its 4 sub-techniques, the ATT&CK mitigations Data Loss Prevention and Restrict Web-Based Content, and how to rehearse the detection in a cyber range.
Detecting T1700 AI-Enabled Exfiltration on Windows and SaaS, using telemetry such as Network Connection Creation, Process Creation and File Access. Covers the ATT&CK mitigations Restrict File and Directory Permissions and Application Isolation and Sandboxing and how to rehearse the detection in a cyber range.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.