In this section of the course,
we'll focus on Exfiltration,
which involves the techniques and tools
to enable attackers to extract data covertly
from compromised systems.
Exfiltration involve transferring data from a target system
to a location controlled by an attacker,
typically done covertly to avoid detection.
This phase is important as it aims
to realize the value of a breach
by securing the stolen information,
which may include system of corporate data,
personally identifiable information,
or intellectual property.
The domain in this section will be sent around Domain 5:
Post-exploitation and Lateral Movement.
Objective 5.3 will be our main focus in this section,
which states that we need to be able
to summarize concept related to staging and exfiltration.
First, we'll jump into Covert Channels,
exploring various methods used to send information
between computers in a way that hides the data
between transfers and monitoring systems.
These techniques,
like steganography and using ICMP channels,
disguise data movements,
making them hard for defensive systems to detect.
Next, a hands-on demo with Steganography will be performed.
As mentioned before, this technique involves hiding data
within non-secure or benign data,
making the presence of hidden data undetectable
to the observer.
We will practice embedded data within images.
Following that, we'll explore Covert Channels using DNS
with a practical demo.
This involves tunneling data
through DNS queries and responses,
a method often overlooked by security systems,
which typically do not inspect DNS traffic deeply.
A demo using ICMP as a Covert Channel will follow,
where you'll learn how to use ICMP packets,
which are generally used for diagnostic purposes
to covertly send data out of the network.
Next, we will demonstrate a Covert Channel using HTTPS,
showcasing how to secretly move data out
over encrypted channels
that appear legitimate to most network security tools.
Alternate Data Streams will be discussed next.
This method involves things
such as using NTFS file attributes to hide data
where the data is not visible in file directory listings,
but still exists on the disc.
Lastly, we will cover the strategies for Exfiltrating Data,
which includes things such as virtual drive mounting,
email, cross-account resources,
and a few other commonly used methods.
Finally, we will take a short quiz to see what you learned
during this section of the course,
and review each of those quiz questions fully
to ensure that you can explain why each answer is right.
So if you're ready
to learn about stealthy techniques used to remove data,
let's begin our section on Exfiltration.