Automated Archive and Exfiltration
Once an adversary has firmly established access within a target environment and identified data of interest, they want to gather and exfiltrate that data. Learn to detect such late-stage threat actor campaign techniques of automated archive and exfiltration in our hands-on course.
2.1What is the “Archive Collected Data: Archive via Utility” Technique?
2.2What is the “Automated Exfiltration” Technique?
2.3Detection, Validation, and Mitigation (Lab)
Archive via Utility most typically occurs later in an attack, when an adversary has gathered sufficient data to warrant archiving the data prior to upload. Then, the "Automated Exfiltration" technique leverages some form of automation to conduct exfiltration activities, rather than rely on manually executed commands. As a primary data theft technique, T1020: Automated Exfiltration will typically occur after an adversary is in the position to act on objectives.
Apply what you learn and get the hands-on skills you need in Cybrary's MITRE ATT&CK Framework courses aligned to the tactics and techniques used by the threat group APT41 (aka Double Dragon). Prevent adversaries from accomplishing the tactics of discovery and persistence.
Complete this entire course to earn a Automated Archive and Exfiltration Certificate of Completion