Forensia CTI Core

About

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet. Examples of cloud storage services include Dropbox and Google Docs. Exfiltration to these cloud storage services can provide a significant amount of cover to the adversary if hosts within the network are already communicating with the service.

Platforms: ESXi, Linux, macOS, WindowsParent: T1567 Exfiltration Over Web ServiceMITRE ATT&CK ↗

Software

16 malware/tools implement this

HAMMERTOSSROKRATOctopusEmpireCrutchRainyDayBoomBoxBoxCaonClamblingCreepyDriveRclonePcexterODAgentOilBoosterRIFLESPINETsundere Botnet

Corpus indicators tagged with this technique

107 indicators in the corpus carry T1567.002.

Indicator	Type	Family	Sev	Src
611db3195d55e871dce67ce5c41e894bbaab88dd0d019af68f5a259f0108aef7	hash	—	80	2
8b283c954d19a839a724961ccaf025c56988c4e745acb2d31a15a006cda072bf	hash	—	80	2
22f335a65c479c26019f6187dae290624117c82a702a96acbb04fa325f730d3e	hash	—	80	2
cff8b04f2c8ed63d37fd393ad23652a8b818e80b03851d7c1bd5842963a03348	sha256	phishing	80	1
523388567630e4fbdc359f75232bf2ad82671a680d4bfdce0237fc30dfec4c80	hash	—	80	1
8a5dadc5faf424df1e8a0efad023df81	hash	—	80	1
e8e7faa5e76dc773ffb1a7a6be36a47cc84e3ed45b928859b570332757cdb6cb	sha256	phishing	80	1
1f385acf11f8ea6673d7295be6492ea9913b525da25dcc037ea49ef4f86a9d58	hash	—	80	2
f4d4b8cac004bb63834c6df436721babd9464c09787c80b268d839e0aada9f87	hash	—	80	1
74bb6ad7e1310f30a3e24fd3cbbffa2c0c41c64e89e5d0dd1d6900e96b914183	hash	—	80	1
442e0f4e822842922e7e4685840194e99fd68c7f0ec38c1925914b8f724d5865	hash	—	80	1
3aae5a24e63f3cb1ca4759b9e4ee8e503ff139189423f5fd8cc923c6819697ca	hash	—	80	2
4a1a6ed11fd50b621659d7976899d050ba2e15d3	hash	—	80	1
7709d8c34d490509f3624104611eb75a862944dd9d7a642f44514ada16c85ee9	hash	—	80	1
340820f7f4c97e3a2477bc99acf746e13b2c92719ebf5c9947a62eef7ec0dddb	sha256	phishing	80	1
9758e76b601798a30d903bf05052a53df80451e5c156548ce9da828f608b6470	sha256	—	80	1
221a39856b37e3c682f62427f1e6b965b36a2405764689c914672770a01a1fa9	sha256	—	80	1
131877a052f62750d815cf55d4c14f606a26025e3094e1b8bb18bd1668e3beaa	hash	ransomware	80	1
ebd533de7ca16daa70093b0b1084fb6136b6ba091d6ee0e4199762581e1b2e5a	sha256	—	80	3
4eebc38297a307d18784d6f9ebc8aa6e6f69860be970cc70d9e544deb1ff6ce0	hash	—	80	1
107b5aa3c4ef30b9b832e0a10b1efb1dcf433158bc6af8d890d66c0c9ed50d21	sha256	—	80	1
e4ccb2328c06710a7f0254cb6315e1b106396b0ff525f9cf3eada6e85d285c1c	sha256	—	80	1
2587217bc685527480c803ddf34a56ae9d9bf02681828a8a2081acc775312cf3	hash	—	80	2
02048121fd0b3a51751ce7677155aa8818eba9d8ce67ea26fd1d7f43cfcdabd2	hash	—	80	2
308351124c496d4f4effee65ab828506abf70385773c167ab1f32a7f030385ac	hash	—	80	2
3b6cb20891bce8602ce669187754871e402a1782031ef8b032cd007e3894bc5d	hash	—	80	2
6a69ea2ce3fea0ebfd7a32a1dfc4251bd4d7d8a4fbd44aaa47b82290d0414a9f	hash	—	80	2
6c700ca4e6d917c7aa9d964e98604a0349d9b8b4673df96a3f73a3d2d042635a	hash	—	80	2
d78f64551d1b31a31e5998e442f0debd458e011e05019b3951d9ddde997f8384	hash	—	80	2
8c0871cd0f60bc603424e948a689945a1828d0bef926a6470ae18cf17d93f7cb	hash	—	80	2

Showing the top 30 by severity of 107.