The Cyber Pilfer Chain: detecting and disrupting post-exploitation data theft
2SANS Blue Team Summit 2023
The Cyber Pilfer Chain: detecting and disrupting post-exploitation data theft
Speaker: Gerard Johansen, Manager - Incident Handling, Red Canary
At the center of many network intrusions is data theft. From confidential research to customer data, the life blood of many organizations are often put up for sale to the highest bidder or held hostage by ransomware gangs. As post-exploitation activity, the process of data theft goes through a similar kill chain where threat actors need to identify data to compromise, access it, aggregate it and finally get it out of the environment. Much like the Cyber Kill Chain, each one of these stages provides opportunities for defenders to stop or otherwise inhibit a threat actor's ability to exfiltrate pilfered data. In this talk, Gerard Johansen will cover the four key phases of the Cyber Pilfer Chain:
- Discovery: How do threat actors find your open shares and other data repositories? This section will focus on how threat actors use post-exploitation tools to identify vulnerable data.
- Access: How do threat actors gain access to open shares? Valid credentials are critical in this phase. This section will focus on how detecting malicious credential use is critical to detecting data theft.
- Aggregation: Threat actors will leverage a compromised system or systems to aggregate compromised data. There they can compress the data and prepare it for exfiltration.
- Exfiltration: Threat actors use a variety of methods to get the data out of the network. This section will focus on network Courses of Action. For each of the stages, common threat actor TTPs are discussed along with Courses of Action that blue teams can take to prevent the theft of data. The overall goal is gaining an understanding of how threat actors carry out data exfiltration and examine the ways that blue teams can identify their activity and shut them down before those confidential memos are up on Pastebin.
View upcoming Summits: http://www.sans.org/u/DuS