BianLian: Exfiltration-Based Extortion

Unusual activity is radiating from a Windows jump host that faces the internet. Before anything else, establish which external address used a valid account to land on that host and how it got in without triggering an MFA challenge.

The attacker's standard-user foothold was not enough. They needed higher privileges to reach the file server and its shares. Determine which elevated account they acquired after landing on the jump host.

Before dumping credentials, the operator downloaded and ran a custom script to survey the environment. Your EDR captured its hash. Provide the SHA-256 of that script.

Somewhere between gaining elevated access and starting the exfil, the operator compiled the target data into a local directory. Identify the MITRE ATT&CK sub-technique that describes bulk staging of data to a location on the same compromised host before exfiltration.

The bulk of the stolen data left the network over a single HTTPS channel opened by a cloud-sync utility. Determine where the data was sent.

The operator did not rely on a single exfiltration path. A second, smaller stream left the network through a different protocol to the same external server that hosted the recon script. Map this secondary channel to its MITRE ATT&CK technique.

The attacker ensured they could resume the exfiltration even if the session was interrupted. A Windows scheduled task was created to keep the upload tool running. Identify the scheduled task name used.

Before disconnecting, the operator wiped evidence from the host. The SIEM shows a distinctive event that signals deliberate removal of Windows audit records. Identify the MITRE ATT&CK sub-technique used.

The cloud audit log records the tenant ID behind the exfil storage account. Confirming it differs from the victim's own tenant proves the destination was attacker-controlled infrastructure. Provide the tenant ID of the storage account that received the stolen data.