Exfiltration TA0010

Overview:

This phase involves attackers attempting to steal sensitive data from a target environment, such as credentials, personally identifiable information (PII), intellectual property, or configuration settings.

In Microsoft Azure, exfiltration tactics are particularly relevant due to the cloud's inherent remote accessibility, shared responsibility model, and the increasing reliance on services such as Entra ID, Azure Storage, and Key Vault.

1️⃣ Exfiltration Over Alternative Protocol (T1048)

What is it?

Instead of using standard data transfer methods (like HTTP/HTTPS or SMB), attackers use alternative network protocols to bypass security controls. This can include:

• DNS tunneling

• ICMP exfiltration

• Custom encrypted protocols (VPNs, TOR, etc.)

• Email or messaging services

Azure-Specific Attack Scenarios

1️⃣ DNS Tunneling via Azure Functions

• An attacker gains access to an Azure VM or container and does not want to trigger standard HTTP-based logging.

• They use a tool like Iodine or dnscat2 to encode stolen data inside DNS queries.

• The Azure VM makes repeated DNS requests to an attacker-controlled domain (e.g., exfil.attacker.com).

• Each query sends a small chunk of base64-encoded data (e.g., API keys, passwords).

2️⃣ ICMP Exfiltration via Azure VM

• The attacker installs a tool like Ptunnel or ICMPExfil on a compromised Azure Virtual Machine.

• Instead of using TCP/UDP, data is embedded in ICMP echo request packets (ping traffic).

• The data reaches an attacker-controlled server running a listening ICMP-based exfiltration service.

2️⃣ Transfer Data to Cloud Account

Attackers move stolen data from a compromised Azure environment to a separate cloud storage account under their control (e.g., an attacker’s AWS S3, Google Drive, or another Azure Storage account).

Attack Examples:

1️⃣ Abusing SAS Tokens for Exfiltration

• A compromised service principal or Azure function retrieves a Storage Account SAS token.

• The attacker uses the SAS token to read & exfiltrate sensitive files from Azure Blob Storage.

• The data is copied to an external cloud account (like AWS S3 or another Azure tenant).

2️⃣ Exfiltrating via Azure Logic Apps

• An attacker gains access to a compromised account with permissions on Azure Logic Apps.

• They create an automated workflow that copies sensitive data from Azure Blob Storage to Google Drive, Dropbox, or another Azure tenant.

• The exfiltration happens as an automated scheduled task, reducing suspicion.

Exfiltration Defense Matrix – Azure Focus (TA0010)

MITRE Technique	Description	Prevention	Detection	Response
T1537 Transfer Data to Cloud Account	Use of authorized or unauthorized cloud apps (Dropbox, Google Drive, AWS S3) to exfiltrate data	- Use MCAS (Microsoft Defender for Cloud Apps) to block unauthorized cloud services - Implement Conditional Access with app restrictions - Disable browser upload from sensitive resources	- MCAS alerts on third-party app usage - Azure Sentinel: App connections from risky locations/devices	- Block access to unsanctioned apps - Revoke session tokens - Review audit logs and re-evaluate RBAC roles
T1567.002 Exfiltration Over Web Service: Cloud Storage	Use of Azure Blob/File Storage (or external) for staging and exfil	- Enforce Private Endpoints on Azure Storage - Disable public access - Rotate and restrict SAS/token usage - Apply DLP rules on sensitive files	- Azure Storage logs: unusual SAS usage, anonymous access - Defender for Storage alerts on mass downloads or IP anomalies	- Revoke SAS tokens - Block source IPs - Rotate storage keys - Investigate download origin and scope
T1048.003 Exfiltration Over Alternative Protocol: DNS	Covert exfil using DNS tunneling (e.g., iodine, dnscat2)	- Block unknown domains using Defender for DNS - Use deny-by-default outbound DNS egress rules - DNS sinkholing for known C2	- Defender for DNS: anomalous FQDN volume or entropy - Azure Firewall logs: frequent TXT record queries	- Alert and isolate compromised host - Block domain/IP - Perform forensic packet analysis
T1048.002 Exfiltration Over Alternative Protocol: ICMP	Exfiltration via ICMP tunnels (e.g., Ptunnel)	- Block ICMP outbound traffic in NSGs - Use Azure Firewall to deny non-essential ICMP	- Flow logs: high-volume ICMP - Defender for Endpoint: tunneling tools on host	- Disable NSG rules - Quarantine VM - Deep-dive host telemetry for tunnel activity
T1048.001 Exfiltration Over Custom Protocol	Use of TOR, VPN, or custom TCP/UDP channels to evade detection	- Block TOR/VPN ports in NSGs - Use Azure Firewall Premium TLS Inspection - Restrict egress to approved destinations	- Defender for Endpoint: VPN/proxy software activity - Firewall logs: encrypted unknown protocols to untrusted IPs	- Block destination in NSG/firewall - Deprovision offending app or function - Initiate containment and IR actions
T1078 Valid Accounts	Exfil using compromised legitimate accounts with storage access	- Enforce MFA & PIM - Disable unused accounts - Audit token issuance and access logs	- Sentinel: suspicious login patterns (geo, device) - Audit logs: abnormal blob/file access	- Revoke session tokens - Reset passwords - Review downstream data exposure
T1552 Unsecured Credentials	Attackers find credentials or keys enabling exfil	- Remove hardcoded creds from repos/pipelines - Use Managed Identity for auth - Apply scanning tools (Defender for DevOps)	- Sentinel alert: secrets found in code - Defender for Key Vault alerts on enumeration	- Revoke exposed creds - Rotate secrets - Conduct credential hygiene review