TA0010Defense Plan

Exfiltration

Exfiltrating data

Techniques in this tactic (2)

T1041Veri Sızdırma ve C2 Kanalları: Exfiltration Teknikleri, OPSEC ve Tespiti T1041Veri Sızdırma ve C2 : Post-exploitation abuse of legitimate channels

Cloud Access Security Broker (CASB)

Visibility and control over SaaS/cloud application usage; OAuth application and data flow monitoring (Defender for Cloud Apps).

ZT: verify explicitlyCASB / SaaS SecurityCloudWindowsmacOS

Data Classification and Rights Management

Data classification and enterprise information rights management (IRM); controls access to sensitive data and prevents unauthorized exfiltration. Foundational to DLP.

ZT: verify explicitlyData Classification / IRMWindowsCloud

M1057Data Loss Prevention

DLP controls that detect and block sensitive data from exiting through unauthorized channels.

ZT: assume breachDLP PolicyWindowsmacOSCloudNetworkSaaS

Source:Veri Sızdırma ve C2 : Post-exploitation abuse of legitimate channels Veri Sızdırma ve C2 Kanalları: Exfiltration Teknikleri, OPSEC ve Tespiti

M1041Encrypt Sensitive Information

Encrypting sensitive data at rest and in transit so it cannot be used even if stolen.

ZT: assume breachEncryption PolicyWindowsLinuxmacOSCloudNetwork

M1037Filter Network Traffic

Restricting inbound/outbound traffic with default-deny filtering, egress control, and anti-spoofing (uRPF/BCP38).

ZT: verify explicitlyFirewall / Egress FilteringNetworkCloud

Source:Veri Sızdırma ve C2 Kanalları: Exfiltration Teknikleri, OPSEC ve Tespiti

M1031Network Intrusion Prevention

IDS/IPS that detects and blocks known malicious patterns and anomalies in network traffic, with proper sensor placement.

ZT: assume breachIDS/IPSNetwork

Source:Veri Sızdırma ve C2 : Post-exploitation abuse of legitimate channels Veri Sızdırma ve C2 Kanalları: Exfiltration Teknikleri, OPSEC ve Tespiti

M1021Restrict Web-Based Content

Narrows egress channels with DNS hardening (protective DNS/RPZ + sinkhole) and web proxy/filtering.

ZT: verify explicitlyWeb/DNS FilteringWindowsLinuxmacOSNetwork

Source:Veri Sızdırma ve C2 Kanalları: Exfiltration Teknikleri, OPSEC ve Tespiti