This article has been indexed from Windows Incident Response
I’ve posted on the topic of data exfiltration before (here, etc.) but often it’s a good idea to revisit the topic. After all, it was almost two years ago that we saw the first instance of ransomware threat actors stating publicly that they’d exfiltrated data from systems, using this a secondary means of extortion. Since then, we’ve continued to see this tactic used, along with other tertiary means of extortion based on data exfiltration. We’ve also seen several instances where the threat actor ransom notes have stated that data was exfiltrated but the public “shaming” sites were noticeably empty.
As long as I’ve been involved in what was first referred to as “information security” (later referred to as “cyber security”), data exfiltration has been a concern to one degree or another, even in the absence of clearly-stated and documented analysis goals. With the advent of PCI forensic investigations (circa 2007-ish), “data exfiltration” became a formalized and documented analysis goal for every investigation, whether the merchant asked for it or not. After all, what value was the collected data if the credit card numbers were extracted from memory and left sitting on the server? Data exfiltration was/is a key component necessary for the crime, and as such, it was assumed often without being clearly identified.
One of the challenges of determining data exfiltration is visibility; systems and networks may simply not be instrumented in a manner that allows us to determine if data exfiltration occurred. By default, Windows systems do not have a great deal of data sources and artifacts that demonstrate data exfiltration in either ..
Support the originator by clicking the read the rest link below.
