Poisoned Pipeline / Techniques / T0145
Bypass of outbound traffic control
Bypass of outbound traffic control in cloud security refers to an attack technique used by threat actors to bypass the security controls implemented by cloud service providers to prevent unauthorized exfiltration of data from their networks.
Threat actors can use various tactics to bypass these outbound traffic controls and exfiltrate data from the cloud network.
For example, they may use encrypted channels such as VPNs or SSL/TLS to hide the data being transferred and make it difficult for the traffic control measures to detect it.
Another tactic that threat actors may use to bypass outbound traffic control is to blend in their data with legitimate traffic, making it harder to detect.
For example attacker may use Webhooks, Code repositories, Cloud storage that are legitimate to bypass outbound traffic control.
They may also use steganography techniques to conceal their data within seemingly innocuous files or images.
Where this idea came from
Cited from a security article or vendor blog in the original YAML; not a first-party incident report.
Mitigations
- M1250 Enable data encryption in transit
- M1450 Implement zero trust
- M1451 Use network segmentation
Detections
- D1510 Implement Intrusion Detection System and anti-malware
Observed in incidents (6)
- TXTBOOK dependency confusion against Tinkoff / T-Bank
- node-ipc 9.1.6 / 9.2.3 / 12.0.1 DNS-exfil stealer
- Team PCP CI/CD secrets campaign
- axios npm remote-access trojan
- crates.io arrayref / proc-macro1 build-time dropper
- Go decimal library typosquat with DNS backdoor