Data Exfiltration — CraftedSignal Threat Feed

Potential Data Exfiltration via Rclone

hello@craftedsignal.io — Mon, 04 May 2026 14:17:05 +0000

Attackers are leveraging Rclone, a legitimate command-line program to manage files on cloud storage, for malicious purposes. The primary abuse case involves renaming Rclone (e.g., to TrendFileSecurityCheck.exe) to evade detection based on process name. Once renamed, attackers use Rclone’s copy/sync functionalities with cloud backends like S3 or HTTP endpoints. They often employ --include filters to target specific sensitive file types for exfiltration. This activity is frequently blended with regular administrative traffic to further obfuscate the malicious intent. Defenders should be aware of this tactic, particularly when unusual processes are observed interacting with cloud storage services.

Attack Chain

The attacker gains initial access to the system through an undisclosed method.
Rclone is downloaded or transferred to the victim machine.
The rclone executable is renamed to a benign-sounding name (e.g., TrendFileSecurityCheck.exe) to masquerade as a legitimate system utility.
The attacker configures rclone to connect to a cloud storage backend (e.g., an S3 bucket or HTTP endpoint) controlled by the attacker.
A command is executed using the renamed rclone executable, specifying the copy or sync command.
The command includes --include flags to filter and select specific file types (e.g., documents, source code, databases) for exfiltration.
Rclone transfers the targeted files from the victim machine to the attacker’s cloud storage backend, potentially using the --transfers option for faster exfiltration.
The attacker accesses the exfiltrated data from their cloud storage.

Impact

Successful exploitation can lead to the exfiltration of sensitive data, including proprietary information, customer data, financial records, or intellectual property. The impact can range from reputational damage and financial losses to legal and regulatory repercussions. The scope of damage depends on the sensitivity and volume of the exfiltrated data, the number of affected systems, and the effectiveness of the attacker’s filtering criteria.

Recommendation

Deploy the Sigma rule Suspicious Rclone Usage to detect renamed rclone executables executing copy/sync commands.
Enable Sysmon process creation logging (Event ID 1) to collect the necessary process execution data for the Sigma rules.
Investigate any process identified by the Sigma rule Suspicious Rclone Usage by examining command-line arguments for cloud backend destinations and --include filters.
Monitor network connections for unusual outbound traffic to cloud storage providers (AWS S3, Azure Blob Storage, Google Cloud Storage) from processes other than approved backup solutions.
Implement application control policies to restrict the execution of unauthorized or renamed executables.

Trigona Ransomware Employing Custom Data Exfiltration Tool

hello@craftedsignal.io — Thu, 23 Apr 2026 19:02:17 +0000

Trigona ransomware, initially launched in October 2022, has been observed using a custom command-line tool named “uploader_client.exe” to exfiltrate data from compromised environments. This shift, observed in March 2026, suggests an effort to avoid detection by security solutions that commonly flag publicly available tools like Rclone and MegaSync. Symantec researchers believe this indicates a strategic investment in proprietary malware to maintain a lower profile during critical phases of attacks. The custom tool supports five simultaneous connections per file for faster data exfiltration via parallel uploads, rotates TCP connections after 2GB of traffic to evade monitoring, offers options for selective file type exfiltration, and utilizes an authentication key to restrict access to stolen data. Despite disruptions in October 2023, Trigona has resumed operations, incorporating additional techniques like installing the Huorong Network Security Suite tool HRSword and disabling security products.

Attack Chain

Initial compromise of the target system through unspecified means.
Installation of the Huorong Network Security Suite tool HRSword as a kernel driver service.
Deployment of tools such as PCHunter, Gmer, YDark, WKTools, DumpGuard, and StpProcessMonitorByovd to disable security-related products by leveraging vulnerable kernel drivers to terminate endpoint protection processes.
Execution of utilities with PowerRun to launch apps, executables, and scripts with elevated privileges, bypassing user-mode protections.
Deployment of AnyDesk for direct remote access to the breached systems.
Execution of Mimikatz and Nirsoft utilities for credential theft and password recovery operations.
Use of the custom “uploader_client.exe” to exfiltrate valuable documents such as invoices and PDFs from network drives via parallel uploads, rotating TCP connections to evade monitoring, and using an authentication key to restrict data access.
Final stage involving the deployment of Trigona ransomware, demanding ransom payment in Monero cryptocurrency.

Impact

Successful Trigona ransomware attacks result in significant data theft and encryption, disrupting business operations and causing financial losses. The group has demonstrated the capability to resume operations even after suffering disruptions, indicating a persistent threat. Observed data exfiltration has included high-value documents such as invoices and PDFs, demonstrating a targeted approach to data theft. Victims face potential regulatory penalties, reputational damage, and recovery costs associated with restoring systems and data. The number of victims and specific financial impact varies per campaign, but the potential for severe disruption and financial strain is consistent.

Recommendation

Monitor process creation events for the execution of “uploader_client.exe” with command-line arguments indicative of data exfiltration (see Sigma rule below).
Implement network monitoring to detect connections to unusual or hardcoded server addresses used by the “uploader_client.exe” exfiltration tool (see IOC table).
Deploy endpoint detection rules to identify the installation of Huorong Network Security Suite (HRSword) as a kernel driver service and tools like PCHunter, Gmer, YDark, WKTools, DumpGuard, and StpProcessMonitorByovd.
Monitor for processes launched via PowerRun, especially if followed by credential dumping or remote access tool execution.
Review AnyDesk usage for unusual connections or after-hours access, as this tool is used for remote access.
Enable robust logging for credential access attempts and password recovery activity associated with Mimikatz and Nirsoft tools.

Unusual Spike in Bytes Written to External Device Detected by Machine Learning

hello@craftedsignal.io — Thu, 02 Apr 2026 12:00:00 +0000

The Data Exfiltration Detection integration, part of the Elastic Security suite, includes a machine learning job designed to detect anomalies in data transfer patterns to external devices. This job, named “ded_high_bytes_written_to_external_device,” identifies unusual increases in the amount of data written to external devices, which could indicate data exfiltration attempts. The system establishes a baseline of normal activity and flags deviations from that baseline, operating on a 15-minute interval and examining data from the preceding two hours. While this rule is intended to detect malicious data exfiltration, legitimate activities like backups, software updates, archiving, and media creation can trigger false positives. The rule is enabled via the Data Exfiltration Detection integration.

Attack Chain

The attacker gains initial access to a system via compromised credentials or other means.
The attacker enumerates sensitive data on the compromised system.
The attacker stages the data for exfiltration, possibly compressing or archiving it.
The attacker connects an external device (e.g., USB drive) to the system.
The attacker initiates a large data transfer to the external device.
The Data Exfiltration Detection machine learning job detects a significant increase in bytes written to the external device, triggering an alert.
The attacker removes the external device containing the exfiltrated data.
The attacker uses the external device to access the stolen data.

Impact

A successful data exfiltration event can result in the loss of sensitive information, potentially leading to financial losses, reputational damage, legal repercussions, and competitive disadvantage. Although the specific number of victims and targeted sectors are not specified, the potential impact is broad, affecting any organization that stores sensitive data on systems accessible to malicious actors. The severity depends on the nature and volume of the exfiltrated data.

Recommendation

Review and tune the Data Exfiltration Detection integration’s configuration, specifically the “ded_high_bytes_written_to_external_device” machine learning job, to reduce false positives related to legitimate data transfer activities.
Implement and enforce data transfer policies to restrict the unauthorized use of external devices and ensure compliance with organizational security standards.
Deploy endpoint detection and response (EDR) solutions to enhance visibility and control over data movements to external devices, as recommended in the rule’s response and remediation guidance.
Investigate any alerts generated by the “Spike in Bytes Sent to an External Device” rule (rule_id: “35a3b253-eea8-46f0-abd3-68bdd47e6e3d”) to determine the legitimacy of the data transfer and take appropriate action.
Consult the investigation guide provided in the rule’s notes section to aid in the triage and analysis of potential data exfiltration incidents.

CrowdStrike Falcon AIDR Supports NVIDIA NeMo Guardrails for AI Agent Protection

hello@craftedsignal.io — Sat, 28 Mar 2026 22:14:01 +0000

The increasing adoption of AI agents in mainstream business operations has created a critical need for robust security measures. CrowdStrike Falcon AIDR now supports NVIDIA NeMo Guardrails (v0.20.0), offering enterprise-grade protection for these AI agents. This integration addresses the challenge of limiting the scope of AI agent actions to prevent abuse and ensure compliance with business goals. It provides a framework that applies constraints on the capabilities of large language models (LLMs). This is crucial as compromised agents can expose sensitive customer data, execute unauthorized transactions, or violate compliance requirements across a wide range of interactions.

Attack Chain

Initial Access/Prompt Injection: An attacker crafts a malicious prompt to inject into the AI agent’s input, aiming to manipulate its behavior (T1566.001).
Bypass Input Sanitization: The malicious prompt attempts to bypass initial input sanitization mechanisms, exploiting vulnerabilities in the agent’s prompt parsing logic.
Agent Logic Manipulation: Successful prompt injection allows the attacker to manipulate the AI agent’s decision-making process, redirecting it towards unauthorized actions.
Data Exfiltration: The compromised AI agent is coerced into exfiltrating sensitive data, such as customer PII or internal business information, through its normal operational channels.
Unauthorized Transactions: The manipulated agent initiates unauthorized transactions, such as fund transfers or policy changes, leveraging its access to backend systems.
Compliance Violation: The agent performs actions that violate compliance regulations, such as disclosing protected health information (PHI) without proper authorization.
Workflow Compromise: The attacker uses the compromised agent to execute malicious workflows that damage business operations.
Impact: The successful exploitation leads to data breaches, financial losses, reputational damage, and legal repercussions for the organization.

Impact

A successful compromise of AI agents could lead to significant damage across various sectors. In financial services, attackers could manipulate transaction logic and exfiltrate sensitive account data. Healthcare organizations face the risk of exposing protected health information (PHI) and compromising medical advice accuracy. Customer service operations could suffer data leaks and policy manipulation, while software development teams could have hardcoded secrets exposed and code injected into their repositories. The number of potential victims depends on the scope and scale of the AI agent deployments, with the potential to affect thousands of customers or internal systems.

Recommendation

Deploy Falcon AIDR with NVIDIA NeMo Guardrails (v0.20.0) to protect AI agents against runtime attacks.
Utilize the built-in classification rules and custom data classification capabilities in Falcon AIDR to define specific security policies.
Implement the provided Sigma rule to detect prompt injection attempts targeting AI agents through user inputs.
Use the provided Sigma rule to detect data exfiltration attempts by AI agents.
Monitor AI agent activity logs to identify suspicious behavior, particularly around data access and transaction initiation.

Speagle Malware Hijacks Cobra DocGuard for Data Exfiltration

hello@craftedsignal.io — Sat, 21 Mar 2026 00:38:59 +0000

A new malware strain dubbed “Speagle” has been discovered leveraging the legitimate Cobra DocGuard software to exfiltrate sensitive data. This malware infects systems and then uses compromised Cobra DocGuard servers as a C2 to receive stolen data. By masquerading as legitimate DocGuard client-server communication, Speagle seeks to evade detection. First reported in March 2026, the malware represents a sophisticated approach to data theft. The threat actors are exploiting trust in a legitimate software product to conceal their activities, making detection more challenging for defenders. The targeting scope is currently unknown, but any organization utilizing Cobra DocGuard should be considered potentially at risk.

Attack Chain

Speagle infects a target machine through an unknown initial access vector.
The malware identifies and hooks into the Cobra DocGuard application.
Speagle harvests sensitive information from the compromised system, focusing on documents and other valuable data.
The gathered data is prepared for exfiltration, likely compressed and encrypted.
Speagle establishes a connection to a compromised Cobra DocGuard server.
The stolen data is transmitted to the compromised server, disguised as legitimate DocGuard client-server traffic.
The attackers retrieve the exfiltrated data from the compromised Cobra DocGuard server.

Impact

Successful Speagle infections can lead to significant data breaches, resulting in the loss of sensitive documents, intellectual property, and confidential information. The number of affected organizations is currently unknown, but any company using Cobra DocGuard is potentially at risk. The impact of a successful attack can range from financial losses and reputational damage to legal and regulatory penalties, depending on the type of data compromised.

Recommendation

Monitor network traffic for unusual communication patterns associated with Cobra DocGuard, even if it appears legitimate (see rules below).
Implement strict access controls and monitoring on Cobra DocGuard servers to detect unauthorized access or data manipulation.
Deploy the Sigma rules in this brief to your SIEM and tune for your environment.
Investigate any Cobra DocGuard client machines exhibiting suspicious behavior, such as unusual file access or network activity.

Apache Artemis and ActiveMQ Artemis Authentication Bypass Vulnerability

hello@craftedsignal.io — Thu, 05 Mar 2026 09:31:38 +0000

On March 5, 2026, the Centre for Cybersecurity Belgium (CCB) issued a warning regarding CVE-2026-27446, a critical authentication bypass vulnerability affecting Apache Artemis and Apache ActiveMQ Artemis. This vulnerability stems from a lack of proper authentication controls within the Core protocol used for communication between brokers. Successful exploitation allows unauthenticated remote attackers to force a target broker to establish an outbound Core federation connection to a rogue broker…

Potential Data Exfiltration to Unusual Geographic Region via Machine Learning

hello@craftedsignal.io — Thu, 02 May 2024 10:00:00 +0000

This alert is triggered by a machine learning job, ded_high_sent_bytes_destination_region_name_ea, that detects data exfiltration to unusual geographical regions based on network traffic patterns. The Data Exfiltration Detection integration, including Elastic Defend and Network Packet Capture, is required for this detection to function. This integration analyzes network and file events to identify abnormalities in data transfer volumes to different geographical locations, specifically by region name. Anomalous traffic patterns, particularly those involving high volumes of data being sent to regions outside the organization’s typical network activity, could indicate malicious actors attempting to exfiltrate sensitive data via command and control channels. This detection provides defenders with an early warning of potential data breaches. Version requirements: Elastic Stack version 9.4.0 or later is required to leverage the Entity Analytics (EA) fields.

Attack Chain

Initial Access: An attacker gains initial access to a system within the network through various means, such as exploiting a vulnerability or using compromised credentials.
Command and Control: The attacker establishes a command and control (C2) channel to communicate with the compromised system.
Data Collection: The attacker identifies and collects sensitive data from various sources within the network.
Staging: The collected data is staged in a temporary location, compressed, and potentially encrypted for exfiltration.
Exfiltration: The attacker uses the C2 channel to transfer the staged data to an external location in an unusual geographic region.
Evasion: The attacker may attempt to obfuscate the data transfer by using techniques such as tunneling or encryption to avoid detection.
Cleanup: The attacker may attempt to remove traces of their activity, such as deleting logs or files, to hinder investigation.

Impact

A successful data exfiltration attack can result in the loss of sensitive information, including intellectual property, customer data, and financial records. The risk score for this rule is 21, which indicates a moderate level of risk. Detection of this activity allows security teams to quickly respond and mitigate the potential damage. Early detection helps prevent large-scale data breaches and minimizes the impact on the organization.

Recommendation

Ensure that the Data Exfiltration Detection integration assets are installed and properly configured, including Elastic Defend and Network Packet Capture (see Setup instructions in content).
Review the geo-location details flagged by the alert to determine if the region is indeed unusual for the organization’s typical network traffic patterns (see Triage and Analysis in content).
Analyze the network traffic logs associated with the alert to identify the volume and type of data being transferred to the unusual region (see Triage and Analysis in content).
Implement geo-blocking measures to restrict data transfers to the identified unusual region, ensuring that only approved regions can communicate with the network (see Response and Remediation in content).
Deploy the Sigma rule below to detect processes initiating network connections to unusual regions based on the DestinationGeoRegion field.

Unusual Remote File Size Indicating Lateral Movement

hello@craftedsignal.io — Tue, 30 Apr 2024 10:00:00 +0000

This detection leverages machine learning to identify unusual remote file sizes, a tactic often used during lateral movement. After gaining initial access, adversaries frequently aim to locate and exfiltrate valuable data. To avoid raising alarms with numerous small transfers, they may consolidate data into a single large file. This rule, built upon the Elastic Lateral Movement Detection integration, specifically uses the lmd_high_file_size_remote_file_transfer_ea machine learning job. The integration requires the host.ip field to be populated and Elastic Defend to be properly configured. This detection is critical for organizations seeking to identify and prevent data exfiltration attempts early in the attack lifecycle. The integration assets must be installed and file and Windows RDP process events collected by Elastic Defend.

Attack Chain

Initial Access: An attacker gains access to a host within the network, potentially through compromised credentials or exploitation of a vulnerability.
Discovery: The attacker performs reconnaissance to identify valuable data stores, network shares, and potential exfiltration targets.
Collection: The attacker gathers sensitive data from various sources within the compromised network. This data could include documents, databases, or other confidential information.
Data Consolidation: To avoid detection, the attacker bundles the collected data into a single, large file. This could involve archiving, compression, or other methods of aggregation.
Lateral Tool Transfer: The attacker uses remote services or tools to transfer the large file to a remote host within the network (T1570).
Exfiltration Preparation: The attacker stages the large file on the remote host, preparing it for exfiltration outside the network.
Exfiltration: The attacker initiates the transfer of the large file from the compromised network to an external destination, potentially using protocols like RDP.
Cleanup: The attacker attempts to remove traces of the activity, such as deleting temporary files or logs, to avoid detection.

Impact

A successful attack can lead to the exfiltration of sensitive data, potentially resulting in financial loss, reputational damage, and legal liabilities. The detection of unusual remote file sizes can help organizations identify and prevent data exfiltration attempts before they cause significant harm. Depending on the sensitivity of the exfiltrated data, the impact could range from minor inconvenience to a major security breach affecting thousands of individuals or customers.

Recommendation

Ensure the host.ip field is populated as required by the rule. For Elastic Defend versions 8.18 and above, verify that host IP collection is enabled following the provided helper guide.
Install the Lateral Movement Detection integration assets, including the lmd_high_file_size_remote_file_transfer_ea machine learning job. Follow the setup instructions detailed in the documentation.
Review and tune the anomaly threshold (anomaly_threshold = 70) of the machine learning job based on your environment’s baseline to reduce false positives.
Implement network segmentation to limit lateral movement, as suggested in the “Response and remediation” section of the rule documentation.
Enhance monitoring and logging for unusual file transfer activities and remote access attempts as stated in the rule documentation.

Spike in Bytes Sent to an External Device via Airdrop

hello@craftedsignal.io — Wed, 03 Jan 2024 15:30:00 +0000

This detection identifies potential data exfiltration attempts via Apple’s Airdrop feature. A machine learning job monitors the volume of data transferred to external devices and flags unusual spikes. While Airdrop facilitates legitimate file sharing between Apple devices, it can be abused by malicious actors to exfiltrate sensitive data. This rule leverages the “ded_high_bytes_written_to_external_device_airdrop_ea” machine learning job and requires the Data Exfiltration Detection integration to be installed, along with network and file events collected by Elastic Defend and Network Packet Capture (for network events only). The rule is designed to detect anomalies in data transfer patterns, providing early warning of potential data breaches.

Attack Chain

Attacker gains initial access to a macOS system within the target network.
Attacker identifies sensitive data stored on the compromised system.
Attacker uses Airdrop to initiate a transfer of the identified data to a nearby device.
The receiving device is controlled by the attacker and configured to accept Airdrop transfers.
A large volume of data is transferred via Airdrop, triggering the machine learning detection.
The data is received by the attacker, completing the exfiltration process.
The attacker may attempt to cover their tracks by deleting files or logs related to the Airdrop transfer.

Impact

Successful exploitation can lead to the unauthorized disclosure of sensitive data. The impact depends on the nature of the exfiltrated data, potentially leading to financial loss, reputational damage, or legal repercussions. The severity is relatively low as it depends on the data being transferred.

Recommendation

Install the Data Exfiltration Detection integration in Elastic, including the preconfigured anomaly detection jobs, as required by the rule setup instructions to enable the machine learning detection (Data Exfiltration Detection integration).
Investigate alerts generated by the “Spike in Bytes Sent to an External Device via Airdrop” rule, focusing on identifying the involved device, user, and the nature of the transferred data (Spike in Bytes Sent to an External Device via Airdrop).
Implement additional monitoring on the affected device and similar devices to detect any further anomalous Airdrop activities, as mentioned in the response and remediation steps (Spike in Bytes Sent to an External Device via Airdrop).

Machine Learning Detects High Bytes Written to External Device

hello@craftedsignal.io — Wed, 03 Jan 2024 15:00:00 +0000

This brief addresses a machine learning detection identifying anomalous data transfer volumes to external devices. The Elastic Data Exfiltration Detection integration includes a prebuilt machine learning job, ded_high_bytes_written_to_external_device_ea, designed to detect spikes in data written to external devices. This behavior is considered anomalous because typical operational settings usually exhibit predictable patterns or ranges of data transfer to external storage. The detection is triggered when the amount of data written significantly deviates from the established baseline, potentially signaling unauthorized data copying or exfiltration attempts. This detection focuses on identifying abnormalities, providing an alert for investigation of possible illicit data transfer activities. The integration requires the Elastic Defend integration to collect file events.

Attack Chain

An attacker gains initial access to a system via compromised credentials or exploiting a vulnerability.
The attacker uses their access to locate and stage sensitive data for exfiltration.
The attacker connects an external storage device, such as a USB drive, to the compromised system.
The attacker initiates a large data transfer operation, copying the staged data to the external device.
Elastic Defend monitors file events and detects a significant increase in bytes written to the external device.
The ded_high_bytes_written_to_external_device_ea machine learning job identifies the unusual data transfer volume.
An alert is triggered based on the anomaly threshold defined in the Data Exfiltration Detection rule.
The attacker removes the external device, completing the exfiltration of the sensitive data.

Impact

Successful exfiltration of data to external devices can lead to significant data breaches. The impact varies depending on the sensitivity and volume of the data stolen. This activity can result in financial losses, reputational damage, legal repercussions, and compromise of intellectual property. While the specific number of affected organizations is unknown, any organization that allows the use of external storage devices is potentially vulnerable. This issue poses a risk across various sectors, particularly those handling sensitive data, such as finance, healthcare, and technology.

Recommendation

Install the Data Exfiltration Detection integration and configure the preconfigured anomaly detection jobs as described in the rule’s setup instructions.
Review and tune the anomaly_threshold (currently set to 75) based on your environment’s baseline data transfer patterns to reduce false positives.
Deploy endpoint detection and response (EDR) solutions to enhance visibility and control over data movements to external devices as mentioned in the “Response and remediation” section of the rule’s note.
Create exceptions for known backup operations, software updates, and data archiving processes that may trigger false positives, referencing the “False positive analysis” section of the rule’s note.
Implement additional monitoring on similar devices and network segments to detect any further anomalous data transfer activities, based on the rule’s description and “Response and remediation” section of the note.

Unusual Process Writing Data to an External Device via Machine Learning

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

This detection identifies unusual processes writing data to external devices, a tactic often used by malicious actors to exfiltrate data while masking their activities with seemingly benign processes. The detection leverages machine learning to identify deviations from typical behavior patterns, specifically focusing on processes that have no legitimate reason to write data to external devices. The rule relies on the “ded_rare_process_writing_to_external_device_ea” machine learning job from the Elastic Data Exfiltration Detection integration, version 9.4.0 or later. The rule analyzes file events collected by integrations such as Elastic Defend and Network Packet Capture. This detection is important because it can uncover exfiltration attempts that might otherwise go unnoticed due to the use of legitimate-looking processes.

Attack Chain

An attacker gains initial access to a system through various means (e.g., compromised credentials, software vulnerability).
The attacker establishes persistence on the system, potentially using scheduled tasks or autorun keys.
The attacker identifies sensitive data on the system or network.
The attacker copies the sensitive data to a staging directory.
The attacker uses a renamed or masqueraded legitimate process (e.g., svchost.exe, powershell.exe) to write the staged data to an external device connected to the system.
The system’s file events are monitored by Elastic Defend, capturing the process writing data to the external device.
The Elastic Data Exfiltration Detection integration analyzes the file events and identifies the process as rare or unusual for writing to external devices.
The “Unusual Process Writing Data to an External Device” rule is triggered, alerting security analysts to the potential exfiltration attempt.

Impact

A successful attack could result in the exfiltration of sensitive data, leading to financial loss, reputational damage, and legal repercussions. While the severity is “low,” a successful exfiltration can have significant consequences. The number of victims and the specific sectors targeted depend on the attacker’s objectives and the compromised system’s access to sensitive information.

Recommendation

Install and configure the Data Exfiltration Detection integration in Elastic, ensuring the machine learning job ded_rare_process_writing_to_external_device_ea is enabled, as described in the setup documentation.
Enable file event collection using Elastic Defend to provide the necessary data for the machine learning job, as detailed in the Elastic Defend documentation.
Deploy the provided Sigma rule to your SIEM and tune the anomaly_threshold based on your environment’s baseline behavior to reduce false positives.
Investigate any alerts generated by this rule, following the triage and analysis guidance to determine the legitimacy of the activity.

Mounting of Hidden or WebDav Remote Shares via Net Utility

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

The threat involves the abuse of the legitimate Windows net.exe utility to mount remote shares, including hidden (e.g., administrative shares) and WebDav shares. This activity may signal lateral movement within a network, preparation for data exfiltration, or initial access through reconnaissance of available network resources. The detection focuses on identifying specific command-line patterns used with net.exe to mount these shares. While the primary data source for the detection rule is Elastic Defend, it also supports data from CrowdStrike, Microsoft Defender XDR, SentinelOne Cloud Funnel, Sysmon, and Windows Security Event Logs. This activity can be masked within normal administrative functions, so tuning and baselining are important.

Attack Chain

An attacker gains initial access to a compromised system through various means (e.g., phishing, exploiting a vulnerability).
The attacker executes net.exe or net1.exe to discover available network shares, identifying potential targets for lateral movement or data exfiltration.
The attacker uses net.exe to attempt to mount a hidden or WebDav share, often using stolen credentials or exploiting existing permissions. The command includes use and specifies a share path like \\\\\ or http(s):///.
If successful, the attacker gains access to the remote share, potentially browsing its contents to identify valuable data or resources.
The attacker copies sensitive data from the remote share to the compromised system.
The attacker stages the exfiltrated data on the compromised system, preparing it for transfer to an external location.
The attacker uses another tool or protocol (e.g., FTP, SCP, web upload) to exfiltrate the data to a destination controlled by the attacker.
The attacker cleans up any traces of their activity on the compromised system and the remote share, attempting to avoid detection.

Impact

Successful exploitation could lead to unauthorized access to sensitive data, lateral movement to other systems, and ultimately, data exfiltration. The mounting of hidden shares gives the attacker the ability to move laterally and escalate their privileges. Depending on the data stored on the shares, data breaches and financial losses are possible. Targeted sectors are broad, as net.exe is a standard Windows utility.

Recommendation

Deploy the “Mounting Hidden or WebDav Remote Shares” rule to your SIEM, tuning it for your environment to minimize false positives and detect suspicious activity.
Enable Sysmon process creation logging (Event ID 1) to capture detailed information about process executions, including net.exe and its command-line arguments as outlined in the rule description.
Investigate and validate any alerts generated by the “Mounting Hidden or WebDav Remote Shares” rule, focusing on the process details, arguments, and associated user accounts, as suggested in the rule’s triage and analysis section.
Implement network segmentation to limit lateral movement possibilities, mitigating the potential impact of successful share mounting as mentioned in the response and remediation steps.

Large ICMP Traffic Detection

hello@craftedsignal.io — Tue, 02 Jan 2024 10:00:00 +0000

This detection focuses on identifying anomalous ICMP (Internet Control Message Protocol) traffic indicative of malicious activity. ICMP is typically used for network diagnostics but can be abused for covert communication, data exfiltration, or command-and-control (C2) by threat actors. This analytic identifies ICMP traffic exceeding 1,000 bytes directed toward external IP addresses, filtering out internal networks. The detection logic leverages the Network_Traffic data model. Validated malicious instances may signal ICMP tunneling, unauthorized data transfer, or compromised endpoints. The data sources for this analytic include Palo Alto Network Traffic and Cisco Secure Access Firewall logs.

Attack Chain

An attacker compromises a host within the network.
The compromised host initiates ICMP traffic to an external IP address.
The ICMP traffic exceeds 1000 bytes, evading default network monitoring thresholds.
The attacker uses ICMP to tunnel data, bypassing normal data transfer protocols.
The compromised host uses ICMP for command and control, receiving instructions from the external attacker.
The attacker establishes a covert communication channel using ICMP, masking their activity within normal network traffic.
Sensitive data is exfiltrated via ICMP packets to the attacker-controlled external server.

Impact

Successful exploitation through large ICMP traffic can lead to data breaches, unauthorized access to internal resources, and the establishment of persistent command and control within the network. ICMP tunneling can bypass traditional security measures, allowing attackers to operate undetected. The impact of successful exploitation includes the potential compromise of sensitive data, disruption of network services, and financial loss.

Recommendation

Deploy the Sigma rule Detect Large ICMP Traffic to your SIEM and tune the byte threshold (currently 1000 bytes) based on your network baseline to minimize false positives.
Investigate any alerts generated by the Detect Large ICMP Traffic rule, focusing on the source and destination IPs involved.
Examine network traffic logs for patterns indicative of ICMP tunneling or covert communication channels, using the provided data sources.
Utilize the provided search View the detection results to review related events and potential lateral movement.
Implement the provided search View risk events to look at risk factors for the involved assets.