Techniques to perform data exfiltration
As with collection, exfiltration can be performed manually by threat actors, or it can be Automated (T1020) using various scripts and tools. The RedCurl (https://www.group-ib.com/resources/research-hub/red-curl/) group we discussed earlier used a PowerShell script, part of which is shown in Figure 9.1, to collect and exfiltrate emails from the victim host:
Figure 9.1 – Part of the PowerShell script collecting and exfiltrating emails
As can be seen in the preceding figure, the emails were collected in a specific file in the %AppData% folder prior to exfiltration.
If adversaries need to transfer data periodically, they can use Scheduled Transfer (T1020) using both standard tools and functionality built into their tools. To avoid attracting unnecessary attention, the data can be split into small chunks and sent one at a time. This technique is called Data Transfer Size Limits (T1030).
As for exfiltration...
