Infringement
Disruption of Business Operations
Excessive Personal Use
Exfiltration via Email
Exfiltration via Media Capture
Exfiltration via Messaging Applications
Exfiltration via Other Network Medium
Exfiltration via Physical Medium
- Exfiltration via Bring Your Own Device (BYOD)
- Exfiltration via Disk Media
- Exfiltration via Floppy Disk
- Exfiltration via New Internal Drive
- Exfiltration via Physical Access to System Drive
- Exfiltration via Physical Documents
- Exfiltration via Target Disk Mode
- Exfiltration via USB Mass Storage Device
- Exfiltration via USB to Mobile Device
- Exfiltration via USB to USB Data Transfer
Exfiltration via Web Service
Inappropriate Web Browsing
Installing Unapproved Software
Misappropriation of Funds
Non-Corporate Device
Providing Access to a Unauthorized Third Party
Public Statements Resulting in Brand Damage
Sharing on AI Chatbot Platforms
Theft
Unauthorized Changes to IT Systems
Unauthorized Printing of Documents
Unauthorized VPN Client
Unlawfully Accessing Copyrighted Material
- ID: IF010.001
- Created: 01st June 2024
- Updated: 22nd September 2024
- Platform: Windows
- Contributor: The ITM Team
Exfiltration via Corporate Email
A subject exfiltrates information using their corporate-issued mailbox, either via software or webmail. They will access the conversation at a later date to retrieve information on a different system.
Prevention
ID | Name | Description |
---|---|---|
PV017 | Prohibit Email Auto-Forwarding to External Domains, Exchange | Various methods can be used within Exchange to prevent internal emails being auto-forwarded to remote domains. This can prevent exfiltration via email auto-forwarding rules. |
Detection
ID | Name | Description |
---|---|---|
DT057 | Chrome Browser Cookies | Google's Chrome browser stores cookies that can reveal valuable insights into user behavior, including login details, session durations, and frequently visited sites.
On Windows, this information is stored in the following location:
This database file can be opened in software such as DB Browser For SQLite. The ‘cookies' table is of interest to understand recent activity within Chrome. |
DT019 | Chrome Browser History | Google's Chrome browser stores the history of accessed websites and files downloaded.
On Windows, this information is stored in the following location:
On macOS:
On Linux:
Where This database file can be opened in software such as DB Browser For SQLite. The ‘downloads’ and ‘urls’ tables are of immediate interest to understand recent activity within Chrome. |
DT058 | Chrome Browser Login Data | Google's Chrome browser stores some login data of accessed websites, that can provide the URLs and usernames used for authentication.
On Windows, this information is stored in the following location:
This file is a database file and can be opened in software such as DB Browser For SQLite. The ‘logins’ and ‘stats’ tables are of immediate interest to understand saved login data.
The passwords are not visible as they are encrypted. However, the encryption key is stored locally and can be used to decrypt saved passwords. The key is stored in the file |
DT048 | Data Loss Prevention Solution | A Data Loss Prevention (DLP) solution refers to policies, technologies, and controls that prevent the accidental and/or deliberate loss, misuse, or theft of data by members of an organization. Typically, DLP technology would take the form of a software agent installed on organization endpoints (such as laptops and servers).
Typical DLP technology will alert on the potential loss of data, or activity which might indicate the potential for data loss. A DLP technology may also provide automated responses to prevent data loss on a device. |
DT041 | Email Gateway | Email gateway solutions offer the ability to trace inbound and outbound emails to an organization. This can be used to retrieve information such as emails sent or received, the subject line, content, attachments, timestamps, and recipients. |
DT040 | Microsoft Exchange Message Trace | Message trace is a feature within Exchange that permits the ability to identify inbound and outbound emails within the organization. This can be used to see which mailboxes have sent or received emails, the time, the subject line, and recipients. |