Forensia CTI Core

About

Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection. When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over C2 Channel and Exfiltration Over Alternative Protocol.

Platforms: Linux, macOS, Network Devices, WindowsMITRE ATT&CK ↗

Used by actors

7 known groups

G0004 Ke3chang G0047 Gamaredon Group G0081 Tropic Trooper G0094 Kimsuky G0121 Sidewinder G1035 Winter Vivern G1039 RedCurl

Software

20 malware/tools implement this

CosmicDukeRoverTINYTYPHONUSBStealerEmpireEburyLightNeuronMacheteAttorShimRatReporterTajMahalStrongPityCrutchDokiPeppyOutSteelRaccoon StealerSolarStrelaStealerHannotog

Corpus indicators tagged with this technique

52 indicators in the corpus carry T1020.

Indicator	Type	Family	Sev	Src
47854deb456cb08c651b7f9ae2f9d87c72d0719de6af233340632efb3c1980f4	sha256	phishing	80	1
1794369214b7f62e70a0485e61335c61	hash	—	80	3
55d6238b01a177e25eb7d53c943f3abea64ec073	hash	phishing	80	2
61e9d76f07334843df561fe4bac449fb6fdaed5e5eb91480bded225f3d265c5f	hash	phishing	80	2
f34f550147c2792c1ff2a003d15be89e5573f0896c5aa6126068baa4621ef416	hash	phishing	80	2
ee6330870087f66a237a7f7c115b65beb042299f12eae1e9004e016686d0c387	hash	phishing	80	2
bc83817c6d2bf8df1d58eac946a12b5e2566b2ffe15cf96f37c711c4b755512b	hash	phishing	80	2
bc090d75f51c293d916c40d4b21094faaec191a42d97448c92d264875bf1f17b	hash	phishing	80	2
6c6cbed6aad96564ed87094785be07a1	hash	phishing	80	2
2758f4d71a2a2dfdefab81737c2d776b2a3dafe5844fdd2157e089a28447ca98	sha256	phishing	80	1
197f11a7b0003aa7da58a3302cfa2a96a670de91d39ddebc7a51ac1d9404a7e6	hash	phishing	80	2
f57e010541fb4ccbf23aefc4a827f753a6ff3f8792d9c04c3eea83f6963c6bae	sha256	phishing	80	1
8e1624d110c090ff57d4b493a9107c66	hash	—	80	3
38353f95fff270f4e3a9d7add8c64666020dd668ce66e15969a736ec48cadc59	sha256	phishing	80	1
4253dd1a4c0867b0be7732f75b2f630cebfb7fed94270e15fb3b12ae40546d01	sha256	phishing	80	1
479ae5fd7274439ddfa27bc03298ebfdfc5ff17f6412acccf74d4dbd90d94218	sha256	phishing	80	1
874bcb1c3d050a5b5b333a2198f504fcb27927c2abdd43b07440188a380c52d5	sha256	phishing	80	1
9eaa577c8ba71646928c1c34c3145536b0498f65f26060a6ba00744bcef57644	sha256	phishing	80	1
a49155df50963d2412534090bbd967749268bd013881ddb81d78b87f91cdc15b	hash	phishing	80	2
91a15554ec9e49c00c5ca301f276bd79d346968651d54204743a08a3ca8a5067	hash	phishing	80	2
7f80add94ee8107a79c87a9b4ccbd33e39eccd1596748a5b88629dd6ac11b86d	hash	phishing	80	2
35af2cf5494181920b8624c7b719d39590e2a5ff5eaa1a2fa1ba86b2b5aa9b43	hash	phishing	80	2
268a8420b791df46380ed9ad69905207e15d8a7c	sha1	phishing	78	1
ee577f1880397a00480b210fcd6bc84d2330a19e	sha1	phishing	78	1
7d415612a00d99617bd89670e1570c145863ad08	sha1	phishing	78	1
eabd440c996846d0992e37ab01d01208	md5	phishing	76	1
7f74bb6ba185978134c318bc5f91d23c	md5	phishing	76	1
6cc3c68c56e099792fdeadde76256d56	md5	phishing	76	1
http://lnstagram.com/wlsperrrrr/	url	—	75	2
https://efficiency-planes-emotions-fascinating.trycloudflare.com	url	—	75	3

Showing the top 30 by severity of 52.