Detecting data collection and exfiltration
When looking for traces of data collection and exfiltration, we can use different approaches. Since threat actors often use scripts or specialized tools, we can start our investigation by looking for evidence of execution. In doing so, we can use the methods discussed in the previous chapters and analyze the following:
- Event Logs
- Prefetch
- UserAssist and RecentApps
- Amcache
- Background Activity Moderator
- Windows Timeline
- System Resource Utilization Monitor
When analyzing these sources, we should pay attention to the execution of programs and system utilities that can be used for collection and exfiltration, as well as to the start of command-line interpreters – cmd, PowerShell, and wmic. Don’t forget that we can also look in the Master File Table for the appearance of new tools or scripts on the filesystem, and in the case of PowerShell we can also refer to the relevant event logs.
If your...
