Data Exfiltration
Difficulty: easy
Log Format: syslog
Data Exfil via FTP
The FTP backup service runs twice a day — 2am and 2pm. Both sessions grab small config files from the internal backup host. Last night there was a third session. From an IP that isn't in the building.
FTPData ExfiltrationService Account
Investigation Scenario
The FTP backup service runs twice a day — 2am and 2pm. Both sessions grab small config files from the internal backup host. Last night there was a third session. From an IP that isn't in the building.