MITRE ATT&CK Techniques

MITRE ATT&CK Techniques Overview

MITRE ATT&CK techniques represent the “how” of an attack - the specific methods adversaries use to accomplish their tactical goals. This section provides detailed analysis of key techniques with AlertKick detection methods and mitigation strategies.

Initial Access Techniques

T1566: Phishing

Description

Adversaries may send phishing messages to gain access to victim systems.

Detection Methods

Email Security Monitoring

# eBPF security rule for phishing detection
- rule: Phishing Email Detected
  desc: Detect suspicious email activities
  condition: >
    (proc.name = "thunderbird" or proc.name = "outlook" or proc.name = "mail") and
    (proc.cmdline contains "suspicious_sender" or proc.cmdline contains "malicious_link")
  output: >
    Phishing email detected
    (user=%user.name email_client=%proc.name)

Network Traffic Analysis

# eBPF security rule for suspicious email traffic
- rule: Suspicious Email Traffic
  desc: Detect suspicious email-related network traffic
  condition: >
    (fd.sport in (25, 587, 993, 995)) and
    (not fd.sip in (trusted_mail_servers))
  output: >
    Suspicious email traffic detected
    (user=%user.name connection=%fd.name)

Required Checks

Email header analysis for spoofing indicators
URL analysis for malicious links
Attachment scanning for malware
Sender reputation checking
User behavior analysis for suspicious clicks

Mitigations

Email security solutions (SPF, DKIM, DMARC)
User training on phishing awareness
Web filtering for malicious URLs
Endpoint protection for malicious attachments

T1190: Exploit Public-Facing Application

Description

Adversaries may attempt to take advantage of a weakness in an Internet-facing computer or program.

Detection Methods

Web Application Monitoring

# eBPF security rule for web application attacks
- rule: Web Application Attack
  desc: Detect web application attack attempts
  condition: >
    (proc.name = "apache" or proc.name = "nginx" or proc.name = "httpd") and
    (proc.cmdline contains "sql" or proc.cmdline contains "injection" or proc.cmdline contains "xss")
  output: >
    Web application attack detected
    (user=%user.name web_server=%proc.name)

Network Traffic Analysis

# eBPF security rule for suspicious HTTP requests
- rule: Suspicious HTTP Request
  desc: Detect suspicious HTTP requests
  condition: >
    (fd.sport in (80, 443, 8080, 8443)) and
    (proc.cmdline contains "sqlmap" or proc.cmdline contains "nikto" or proc.cmdline contains "nmap")
  output: >
    Suspicious HTTP request detected
    (user=%user.name request=%proc.cmdline)

Required Checks

Web server logs analysis for attack patterns
SQL injection detection in database queries
XSS attempts in web applications
Directory traversal attempts
Authentication bypass attempts

Mitigations

Web application firewalls (WAF)
Regular security testing and patching
Input validation and sanitization
Secure coding practices

Execution Techniques

T1059: Command and Scripting Interpreter

Description

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

Detection Methods

PowerShell Monitoring

# eBPF security rule for PowerShell abuse
- rule: PowerShell Abuse
  desc: Detect suspicious PowerShell usage
  condition: >
    (proc.name = "powershell" or proc.name = "pwsh") and
    (proc.cmdline contains "-enc" or proc.cmdline contains "-e" or proc.cmdline contains "base64")
  output: >
    PowerShell abuse detected
    (user=%user.name command=%proc.cmdline)

Script Execution Monitoring

# eBPF security rule for script execution
- rule: Suspicious Script Execution
  desc: Detect suspicious script execution
  condition: >
    (proc.name = "python" or proc.name = "perl" or proc.name = "ruby") and
    (proc.cmdline contains "download" or proc.cmdline contains "execute" or proc.cmdline contains "payload")
  output: >
    Suspicious script execution detected
    (user=%user.name script=%proc.cmdline)

Required Checks

Command line analysis for suspicious parameters
Script content analysis for malicious code
Process execution monitoring
Network connections from script execution
File system changes from script execution

Mitigations

Script execution policies and restrictions
Application whitelisting for interpreters
User training on script security
Endpoint detection and response (EDR)

T1053: Scheduled Task/Job

Description

Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.

Detection Methods

Scheduled Task Monitoring

# eBPF security rule for suspicious scheduled tasks
- rule: Suspicious Scheduled Task
  desc: Detect creation of suspicious scheduled tasks
  condition: >
    (proc.name = "schtasks" or proc.name = "at" or proc.name = "crontab") and
    (proc.cmdline contains "create" or proc.cmdline contains "add" or proc.cmdline contains "edit")
  output: >
    Suspicious scheduled task detected
    (user=%user.name command=%proc.cmdline)

Cron Job Monitoring

# eBPF security rule for suspicious cron jobs
- rule: Suspicious Cron Job
  desc: Detect suspicious cron job creation
  condition: >
    (proc.name = "crontab" or proc.name = "cron") and
    (proc.cmdline contains "suspicious_command" or proc.cmdline contains "malicious_script")
  output: >
    Suspicious cron job detected
    (user=%user.name command=%proc.cmdline)

Required Checks

Scheduled task creation and modification
Cron job creation and modification
Task execution monitoring
Command analysis in scheduled tasks
User permissions for task creation

Mitigations

Scheduled task monitoring and auditing
User permissions for task scheduling
Task content validation and approval
Regular review of scheduled tasks

Persistence Techniques

T1547: Boot or Logon Autostart Execution

Description

Adversaries may configure system settings to automatically execute a program during system boot or logon.

Detection Methods

Registry Monitoring

# eBPF security rule for autostart registry modifications
- rule: Autostart Registry Modification
  desc: Detect modifications to autostart registry keys
  condition: >
    (reg.key contains "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" or
     reg.key contains "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run") and
    (reg.type = "set" or reg.type = "create")
  output: >
    Autostart registry modification detected
    (user=%user.name key=%reg.key value=%reg.value)

Startup Folder Monitoring

# eBPF security rule for startup folder modifications
- rule: Startup Folder Modification
  desc: Detect modifications to startup folders
  condition: >
    (fd.name contains "Startup" or fd.name contains "startup") and
    (proc.cmdline contains "copy" or proc.cmdline contains "move" or proc.cmdline contains "create")
  output: >
    Startup folder modification detected
    (user=%user.name file=%fd.name)

Required Checks

Registry key modifications for autostart
Startup folder file additions
Service installation for autostart
Group Policy modifications
User profile modifications

Mitigations

Registry monitoring and protection
Startup folder monitoring and protection
Service management and monitoring
User profile protection

T1543: Create or Modify System Process

Description

Adversaries may create or modify system-level processes to repeatedly execute malicious payloads.

Detection Methods

Service Creation Monitoring

# eBPF security rule for service creation
- rule: Service Creation
  desc: Detect creation of suspicious services
  condition: >
    (proc.name = "sc" or proc.name = "net" or proc.name = "systemctl") and
    (proc.cmdline contains "create" or proc.cmdline contains "install" or proc.cmdline contains "enable")
  output: >
    Service creation detected
    (user=%user.name command=%proc.cmdline)

Process Creation Monitoring

# eBPF security rule for suspicious process creation
- rule: Suspicious Process Creation
  desc: Detect creation of suspicious processes
  condition: >
    (proc.name in (suspicious_processes)) and
    (proc.cmdline contains "persistent" or proc.cmdline contains "autostart")
  output: >
    Suspicious process creation detected
    (user=%user.name process=%proc.name)

Required Checks

Service creation and modification
Process creation monitoring
Service configuration analysis
User permissions for service creation
Service execution monitoring

Mitigations

Service management and monitoring
Process monitoring and protection
User permissions for service creation
Service configuration validation

Privilege Escalation Techniques

T1068: Exploitation for Privilege Escalation

Description

Adversaries may exploit software vulnerabilities in an attempt to collect credentials or escalate privileges.

Detection Methods

Exploit Detection

# eBPF security rule for privilege escalation attempts
- rule: Privilege Escalation Attempt
  desc: Detect privilege escalation attempts
  condition: >
    (proc.name = "sudo" or proc.name = "su" or proc.name = "runas") and
    (proc.cmdline contains "root" or proc.cmdline contains "administrator" or proc.cmdline contains "elevate")
  output: >
    Privilege escalation attempt detected
    (user=%user.name command=%proc.cmdline)

System Call Monitoring

# eBPF security rule for suspicious system calls
- rule: Suspicious System Call
  desc: Detect suspicious system calls for privilege escalation
  condition: >
    (syscall.name = "setuid" or syscall.name = "setgid" or syscall.name = "setreuid") and
    (proc.cmdline contains "escalate" or proc.cmdline contains "privilege")
  output: >
    Suspicious system call detected
    (user=%user.name syscall=%syscall.name)

Required Checks

System call monitoring for privilege changes
Process execution with elevated privileges
User account changes and modifications
Service execution with system privileges
File system access with elevated privileges

Mitigations

Regular patching and vulnerability management
Privilege management and least privilege
System hardening and configuration
User account monitoring and protection

T1134: Access Token Manipulation

Description

Adversaries may modify access tokens to operate under a different user or system security context.

Detection Methods

Token Manipulation Monitoring

# eBPF security rule for token manipulation
- rule: Token Manipulation
  desc: Detect token manipulation activities
  condition: >
    (proc.name = "mimikatz" or proc.name = "sekurlsa" or proc.name = "wce") and
    (proc.cmdline contains "token" or proc.cmdline contains "credential")
  output: >
    Token manipulation detected
    (user=%user.name tool=%proc.name)

Process Token Monitoring

# eBPF security rule for process token changes
- rule: Process Token Change
  desc: Detect process token changes
  condition: >
    (syscall.name = "setuid" or syscall.name = "setgid") and
    (proc.cmdline contains "impersonate" or proc.cmdline contains "token")
  output: >
    Process token change detected
    (user=%user.name syscall=%syscall.name)

Required Checks

Token manipulation tool usage
Process token changes and modifications
User impersonation attempts
Credential theft activities
System call monitoring for token operations

Mitigations

Token protection and monitoring
User account protection and monitoring
Credential management and protection
System hardening and configuration

Defense Evasion Techniques

T1562: Impair Defenses

Description

Adversaries may disable or modify security tools to avoid detection.

Detection Methods

Security Tool Monitoring

# eBPF security rule for security tool tampering
- rule: Security Tool Tampering
  desc: Detect tampering with security tools
  condition: >
    (proc.name in (security_tools) and proc.cmdline contains "stop") or
    (proc.name in (security_tools) and proc.cmdline contains "disable") or
    (proc.name in (security_tools) and proc.cmdline contains "uninstall")
  output: >
    Security tool tampering detected
    (user=%user.name tool=%proc.name command=%proc.cmdline)

Log Tampering Monitoring

# eBPF security rule for log tampering
- rule: Log Tampering
  desc: Detect log tampering activities
  condition: >
    (fd.name contains "/var/log" or fd.name contains "/var/audit") and
    (proc.cmdline contains "rm" or proc.cmdline contains "truncate" or proc.cmdline contains "delete")
  output: >
    Log tampering detected
    (user=%user.name file=%fd.name command=%proc.cmdline)

Required Checks

Security tool status and configuration
Log file integrity and modification
Service status for security services
Configuration file modifications
User permissions for security tools

Mitigations

Security tool protection and monitoring
Log integrity monitoring and protection
Service protection and monitoring
Configuration management and monitoring

T1036: Masquerading

Description

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate.

Detection Methods

File Masquerading Monitoring

# eBPF security rule for file masquerading
- rule: File Masquerading
  desc: Detect file masquerading activities
  condition: >
    (proc.name = "mv" or proc.name = "copy" or proc.name = "rename") and
    (proc.cmdline contains "system" or proc.cmdline contains "windows" or proc.cmdline contains "update")
  output: >
    File masquerading detected
    (user=%user.name command=%proc.cmdline)

Process Masquerading Monitoring

# eBPF security rule for process masquerading
- rule: Process Masquerading
  desc: Detect process masquerading activities
  condition: >
    (proc.name in (system_processes) and proc.cmdline contains "suspicious") or
    (proc.name in (system_processes) and proc.cmdline contains "malicious")
  output: >
    Process masquerading detected
    (user=%user.name process=%proc.name)

Required Checks

File name analysis for masquerading
Process name analysis for masquerading
File content analysis for legitimacy
Process behavior analysis for anomalies
System file integrity checking

Mitigations

File integrity monitoring and protection
Process monitoring and protection
System file protection and monitoring
User training on security awareness

Credential Access Techniques

T1110: Brute Force

Description

Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.

Detection Methods

Authentication Monitoring

# eBPF security rule for brute force attacks
- rule: Brute Force Attack
  desc: Detect brute force authentication attempts
  condition: >
    (proc.name = "ssh" or proc.name = "su" or proc.name = "login") and
    (proc.cmdline contains "failed" or proc.cmdline contains "denied" or proc.cmdline contains "invalid")
  output: >
    Brute force attack detected
    (user=%user.name attempts=%proc.cmdline)

# eBPF security rule for multiple login attempts
- rule: Multiple Login Attempts
  desc: Detect multiple failed login attempts
  condition: >
    (proc.name = "sshd" or proc.name = "login" or proc.name = "su") and
    (proc.cmdline contains "authentication failure" or proc.cmdline contains "invalid user")
  output: >
    Multiple login attempts detected
    (user=%user.name service=%proc.name)

Required Checks

Authentication failures counting and analysis
Login attempt patterns and timing
User account lockout monitoring
IP address analysis for attack sources
Service status monitoring for authentication services

Mitigations

Account lockout policies and monitoring
Rate limiting for authentication attempts
Multi-factor authentication implementation
Network monitoring and blocking

T1555: Credentials from Password Stores

Description

Adversaries may search for common password storage locations to obtain user credentials.

Detection Methods

Password Store Monitoring

# eBPF security rule for password store access
- rule: Password Store Access
  desc: Detect access to password stores
  condition: >
    (proc.name = "keychain" or proc.name = "credential" or proc.name = "password") and
    (proc.cmdline contains "dump" or proc.cmdline contains "extract" or proc.cmdline contains "export")
  output: >
    Password store access detected
    (user=%user.name tool=%proc.name)

Credential Theft Monitoring

# eBPF security rule for credential theft
- rule: Credential Theft
  desc: Detect credential theft activities
  condition: >
    (proc.name = "mimikatz" or proc.name = "sekurlsa" or proc.name = "wce") and
    (proc.cmdline contains "credential" or proc.cmdline contains "password" or proc.cmdline contains "hash")
  output: >
    Credential theft detected
    (user=%user.name tool=%proc.name)

Required Checks

Password store access and modification
Credential extraction tool usage
User credential access patterns
File system access to credential stores
Network traffic analysis for credential theft

Mitigations

Credential management and protection
Password store protection and monitoring
User training on credential security
Endpoint protection for credential theft tools

Discovery Techniques

T1082: System Information Discovery

Description

An adversary may attempt to get detailed information about the operating system and hardware.

Detection Methods

System Enumeration Monitoring

# eBPF security rule for system enumeration
- rule: System Enumeration
  desc: Detect system enumeration activities
  condition: >
    (proc.name = "whoami" or proc.name = "id" or proc.name = "uname") or
    (proc.name = "ps" or proc.name = "top" or proc.name = "htop") or
    (proc.name = "ls" or proc.name = "dir" or proc.name = "find")
  output: >
    System enumeration detected
    (user=%user.name command=%proc.cmdline)

System Information Gathering

# eBPF security rule for system information gathering
- rule: System Information Gathering
  desc: Detect system information gathering activities
  condition: >
    (proc.name = "systeminfo" or proc.name = "uname" or proc.name = "hostname") or
    (proc.name = "ifconfig" or proc.name = "ip" or proc.name = "netstat")
  output: >
    System information gathering detected
    (user=%user.name command=%proc.cmdline)

Required Checks

System command execution monitoring
Information gathering tool usage
User behavior analysis for enumeration
System access patterns and timing
Network scanning activities

Mitigations

User monitoring and behavior analysis
System hardening and configuration
Network segmentation and access controls
Security awareness training

T1046: Network Service Scanning

Description

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure.

Detection Methods

Network Scanning Monitoring

# eBPF security rule for network scanning
- rule: Network Scanning
  desc: Detect network scanning activities
  condition: >
    (proc.name = "nmap" or proc.name = "netstat" or proc.name = "ss") or
    (proc.name = "ping" or proc.name = "traceroute" or proc.name = "telnet")
  output: >
    Network scanning detected
    (user=%user.name command=%proc.cmdline)

Port Scanning Monitoring

# eBPF security rule for port scanning
- rule: Port Scanning
  desc: Detect port scanning activities
  condition: >
    (proc.name = "nmap" or proc.name = "masscan" or proc.name = "zmap") and
    (proc.cmdline contains "scan" or proc.cmdline contains "port" or proc.cmdline contains "host")
  output: >
    Port scanning detected
    (user=%user.name command=%proc.cmdline)

Required Checks

Network scanning tool usage
Port scanning activities and patterns
Network traffic analysis for scanning
User permissions for network access
Scanning target analysis and monitoring

Mitigations

Network monitoring and traffic analysis
Network segmentation and access controls
User permissions for network tools
Security awareness training

Lateral Movement Techniques

T1021: Remote Services

Description

Adversaries may use remote services to initially access and/or persist within a network.

Detection Methods

Remote Access Monitoring

# eBPF security rule for remote access
- rule: Remote Access
  desc: Detect remote access activities
  condition: >
    (proc.name = "ssh" or proc.name = "rdesktop" or proc.name = "vncviewer") or
    (proc.name = "psexec" or proc.name = "wmic" or proc.name = "powershell")
  output: >
    Remote access detected
    (user=%user.name command=%proc.cmdline)

Lateral Movement Monitoring

# eBPF security rule for lateral movement
- rule: Lateral Movement
  desc: Detect lateral movement activities
  condition: >
    (proc.name = "scp" or proc.name = "rsync" or proc.name = "ftp") and
    (proc.cmdline contains "copy" or proc.cmdline contains "transfer" or proc.cmdline contains "move")
  output: >
    Lateral movement detected
    (user=%user.name command=%proc.cmdline)

Required Checks

Remote access tool usage and patterns
Network connections for lateral movement
User authentication for remote services
File transfer activities and monitoring
Service access patterns and timing

Mitigations

Network segmentation and access controls
Multi-factor authentication for remote access
User monitoring and behavior analysis
Network monitoring and traffic analysis

T1550: Use Alternate Authentication Material

Description

Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens.

Detection Methods

Credential Reuse Monitoring

# eBPF security rule for credential reuse
- rule: Credential Reuse
  desc: Detect credential reuse activities
  condition: >
    (proc.name = "mimikatz" or proc.name = "sekurlsa" or proc.name = "wce") and
    (proc.cmdline contains "pass" or proc.cmdline contains "hash" or proc.cmdline contains "ticket")
  output: >
    Credential reuse detected
    (user=%user.name tool=%proc.name)

Token Theft Monitoring

# eBPF security rule for token theft
- rule: Token Theft
  desc: Detect token theft activities
  condition: >
    (proc.name = "mimikatz" or proc.name = "sekurlsa" or proc.name = "wce") and
    (proc.cmdline contains "token" or proc.cmdline contains "ticket" or proc.cmdline contains "credential")
  output: >
    Token theft detected
    (user=%user.name tool=%proc.name)

Required Checks

Credential reuse tool usage
Token theft activities and patterns
Authentication bypass attempts
User credential access and usage
Network traffic analysis for credential theft

Mitigations

Credential management and protection
Token protection and monitoring
User account protection and monitoring
Network monitoring and traffic analysis

Collection Techniques

T1005: Data from Local System

Description

Adversaries may search local system sources to find files of interest.

Detection Methods

Data Collection Monitoring

# eBPF security rule for data collection
- rule: Data Collection
  desc: Detect data collection activities
  condition: >
    (proc.name = "find" or proc.name = "grep" or proc.name = "search") or
    (proc.name = "copy" or proc.name = "cp" or proc.name = "robocopy")
  output: >
    Data collection detected
    (user=%user.name command=%proc.cmdline)

File Access Monitoring

# eBPF security rule for file access
- rule: File Access
  desc: Detect file access activities
  condition: >
    (fd.name contains "sensitive" or fd.name contains "confidential" or fd.name contains "secret") and
    (proc.cmdline contains "read" or proc.cmdline contains "open" or proc.cmdline contains "access")
  output: >
    File access detected
    (user=%user.name file=%fd.name)

Required Checks

File access patterns and monitoring
Data collection tool usage
Sensitive file access and monitoring
User permissions for file access
File system changes and modifications

Mitigations

File system monitoring and protection
Data classification and access controls
User monitoring and behavior analysis
Data loss prevention solutions

T1039: Data from Network Shared Drive

Description

Adversaries may search network shares on computers they have compromised to find files of interest.

Detection Methods

# eBPF security rule for network share access
- rule: Network Share Access
  desc: Detect network share access activities
  condition: >
    (proc.name = "smbclient" or proc.name = "net" or proc.name = "mount") and
    (proc.cmdline contains "share" or proc.cmdline contains "network" or proc.cmdline contains "remote")
  output: >
    Network share access detected
    (user=%user.name command=%proc.cmdline)

File Transfer Monitoring

# eBPF security rule for file transfer
- rule: File Transfer
  desc: Detect file transfer activities
  condition: >
    (proc.name = "scp" or proc.name = "rsync" or proc.name = "ftp") and
    (proc.cmdline contains "copy" or proc.cmdline contains "transfer" or proc.cmdline contains "download")
  output: >
    File transfer detected
    (user=%user.name command=%proc.cmdline)

Required Checks

Network share access and monitoring
File transfer activities and patterns
User permissions for network access
Network traffic analysis for file transfers
Data access patterns and monitoring

Mitigations

Network segmentation and access controls
File system monitoring and protection
User monitoring and behavior analysis
Data loss prevention solutions

Command and Control Techniques

T1071: Application Layer Protocol

Description

Adversaries may communicate using application layer protocols to avoid detection/network filtering.

Detection Methods

Protocol Monitoring

# eBPF security rule for application layer protocol
- rule: Application Layer Protocol
  desc: Detect application layer protocol usage
  condition: >
    (fd.sport in (80, 443, 53)) and
    (proc.cmdline contains "curl" or proc.cmdline contains "wget" or proc.cmdline contains "nc")
  output: >
    Application layer protocol detected
    (user=%user.name connection=%fd.name)

DNS Tunneling Monitoring

# eBPF security rule for DNS tunneling
- rule: DNS Tunneling
  desc: Detect DNS tunneling activities
  condition: >
    (proc.name = "nslookup" or proc.name = "dig" or proc.name = "host") and
    (proc.cmdline contains "suspicious_domain" or proc.cmdline contains "malicious_domain")
  output: >
    DNS tunneling detected
    (user=%user.name domain=%proc.cmdline)

Required Checks

Network protocol analysis and monitoring
DNS traffic analysis for tunneling
Application layer protocol usage
Network traffic patterns and analysis
User behavior analysis for protocol usage

Mitigations

Network monitoring and traffic analysis
DNS filtering and monitoring
Protocol analysis and monitoring
User monitoring and behavior analysis

T1102: Web Service

Description

Adversaries may use an existing, legitimate, external web service as a means for command and control.

Detection Methods

Web Service Monitoring

# eBPF security rule for web service usage
- rule: Web Service Usage
  desc: Detect web service usage for C2
  condition: >
    (proc.name = "curl" or proc.name = "wget" or proc.name = "python") and
    (proc.cmdline contains "github" or proc.cmdline contains "dropbox" or proc.cmdline contains "onedrive")
  output: >
    Web service usage detected
    (user=%user.name service=%proc.cmdline)

Cloud Service Monitoring

# eBPF security rule for cloud service usage
- rule: Cloud Service Usage
  desc: Detect cloud service usage for C2
  condition: >
    (proc.name = "aws" or proc.name = "gcloud" or proc.name = "azure") and
    (proc.cmdline contains "upload" or proc.cmdline contains "download" or proc.cmdline contains "sync")
  output: >
    Cloud service usage detected
    (user=%user.name service=%proc.cmdline)

Required Checks

Web service usage and monitoring
Cloud service access and monitoring
Network traffic analysis for C2
User behavior analysis for service usage
Service configuration and monitoring

Mitigations

Web service monitoring and filtering
Cloud service monitoring and access controls
Network monitoring and traffic analysis
User monitoring and behavior analysis

Exfiltration Techniques

T1020: Automated Exfiltration

Description

Adversaries may exfiltrate data in an automated manner without user interaction.

Detection Methods

Automated Transfer Monitoring

# eBPF security rule for automated transfer
- rule: Automated Transfer
  desc: Detect automated data transfer
  condition: >
    (proc.name = "scp" or proc.name = "rsync" or proc.name = "ftp") and
    (proc.cmdline contains "automated" or proc.cmdline contains "scheduled" or proc.cmdline contains "batch")
  output: >
    Automated transfer detected
    (user=%user.name command=%proc.cmdline)

Scheduled Transfer Monitoring

# eBPF security rule for scheduled transfer
- rule: Scheduled Transfer
  desc: Detect scheduled data transfer
  condition: >
    (proc.name = "cron" or proc.name = "at" or proc.name = "schtasks") and
    (proc.cmdline contains "transfer" or proc.cmdline contains "upload" or proc.cmdline contains "sync")
  output: >
    Scheduled transfer detected
    (user=%user.name command=%proc.cmdline)

Required Checks

Automated transfer tool usage
Scheduled transfer activities
Data transfer patterns and timing
Network traffic analysis for transfers
User behavior analysis for automation

Mitigations

Data loss prevention solutions
Network monitoring and traffic analysis
User monitoring and behavior analysis
Automation monitoring and controls

T1048: Exfiltration Over Alternative Protocol

Description

Adversaries may steal data by exfiltrating it over an alternative protocol.

Detection Methods

Alternative Protocol Monitoring

# eBPF security rule for alternative protocol
- rule: Alternative Protocol
  desc: Detect alternative protocol usage
  condition: >
    (fd.sport in (53, 123, 161)) and
    (proc.cmdline contains "dns" or proc.cmdline contains "ntp" or proc.cmdline contains "snmp")
  output: >
    Alternative protocol detected
    (user=%user.name protocol=%fd.sport)

Protocol Abuse Monitoring

# eBPF security rule for protocol abuse
- rule: Protocol Abuse
  desc: Detect protocol abuse for exfiltration
  condition: >
    (proc.name = "nslookup" or proc.name = "dig" or proc.name = "snmpwalk") and
    (proc.cmdline contains "exfiltrate" or proc.cmdline contains "steal" or proc.cmdline contains "data")
  output: >
    Protocol abuse detected
    (user=%user.name tool=%proc.name)

Required Checks

Alternative protocol usage and monitoring
Protocol abuse activities and patterns
Network traffic analysis for protocol usage
User behavior analysis for protocol usage
Service configuration and monitoring

Mitigations

Protocol monitoring and filtering
Network monitoring and traffic analysis
User monitoring and behavior analysis
Service configuration and monitoring

Impact Techniques

T1485: Data Destruction

Description

Adversaries may destroy data and files on specific systems or in large numbers on a network.

Detection Methods

Data Destruction Monitoring

# eBPF security rule for data destruction
- rule: Data Destruction
  desc: Detect data destruction activities
  condition: >
    (proc.name = "rm" or proc.name = "del" or proc.name = "format") and
    (proc.cmdline contains "destroy" or proc.cmdline contains "delete" or proc.cmdline contains "wipe")
  output: >
    Data destruction detected
    (user=%user.name command=%proc.cmdline)

File Deletion Monitoring

# eBPF security rule for file deletion
- rule: File Deletion
  desc: Detect file deletion activities
  condition: >
    (proc.name = "rm" or proc.name = "del" or proc.name = "unlink") and
    (proc.cmdline contains "large" or proc.cmdline contains "bulk" or proc.cmdline contains "mass")
  output: >
    File deletion detected
    (user=%user.name command=%proc.cmdline)

Required Checks

File deletion activities and patterns
Data destruction tool usage
File system changes and monitoring
User permissions for file deletion
System impact assessment and monitoring

Mitigations

Backup and recovery procedures
File system monitoring and protection
User permissions for file deletion
System monitoring and alerting

T1486: Data Encrypted for Impact

Description

Adversaries may encrypt data on target systems or on large numbers of systems in a network.

Detection Methods

Encryption Monitoring

# eBPF security rule for encryption
- rule: Encryption
  desc: Detect encryption activities
  condition: >
    (proc.name = "gpg" or proc.name = "openssl" or proc.name = "cryptsetup") and
    (proc.cmdline contains "encrypt" or proc.cmdline contains "cipher" or proc.cmdline contains "crypto")
  output: >
    Encryption detected
    (user=%user.name tool=%proc.name)

Ransomware Monitoring

# eBPF security rule for ransomware
- rule: Ransomware
  desc: Detect ransomware activities
  condition: >
    (proc.name = "encrypt" or proc.name = "ransom" or proc.name = "crypto") and
    (proc.cmdline contains "ransom" or proc.cmdline contains "encrypt" or proc.cmdline contains "lock")
  output: >
    Ransomware detected
    (user=%user.name tool=%proc.name)

Required Checks

Encryption tool usage and monitoring
Ransomware activities and patterns
File system changes and monitoring
User behavior analysis for encryption
System impact assessment and monitoring

Mitigations

Backup and recovery procedures
File system monitoring and protection
User training on security awareness
System monitoring and alerting

Next Steps

MITRE Mitigations - Security control implementation
Security Monitoring Setup - Configure AlertKick for MITRE detection