This article has been indexed from Windows Incident Response
I’ve posted on the topic of data exfiltration before (here, etc.) but often it’s a good idea to revisit the topic. After all, it was almost two years ago that we saw the first instance of ransomware threat actors stating publicly that they’d exfiltrated data from systems, using this a secondary means of extortion. Since then, we’ve continued to see this tactic used, along with other tertiary means of extortion based on data exfiltration. We’ve also seen several instances where the threat actor ransom notes have stated that data was exfiltrated but the public “shaming” sites were noticeably empty.
As long as I’ve been involved in what was first referred to as “information security” (later referred to as “cyber security”), data exfiltration has been a concern to one degree or another, even in the absence of clearly-stated and documented analysis goals. With the advent of PCI forensic investigations (circa 2007-ish), “data exfiltration” became a formalized and documented analysis goal for every investigation, whether the merchant asked for it or not. After all, what value was the collected data if the credit card numbers were extracted from memory and left sitting on the server? Data exfiltration was/is a key component necessary for the crime, and as such, it was assumed often without being clearly identified.
One of the challenges of determining data exfiltration is visibility; systems and networks may simply not be instrumented in a manner that allows us to determine if data exfiltration occurred. By default, Windows systems do not have a great deal of data sources and artifacts that demonstrate data exfiltration in either a definitive or secondary manner. While some do exist, they very often are not clearly understood and investigated by those who then state, “…there was no evidence of data exfiltration observed…” in their findings.
Many years ago, I responded to an incident where an employee’s home system had been compromised and a keystroke logger installed. The threat actor observed through the logs that the employee had remote access to their work infrastructure, and proceeded to use the same credentials to log into the corporate infrastructure. These were all Windows XP and 2003 systems, so artifacts (logs and other data sources) were limited in comparison to more modern versions of Windows, but we had enough indicators to determine tha
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.
Read the original article: Data Exfiltration, Revisited