They brought their own key
Seven sessions in one week wrote a private key to disk and used it to pull their payload with scp, from an account on the attacker's own server. Only if that fails do they fall back to wget and curl. The key material is redacted here and the host is masked to /16. Most egress rules are written around web downloads, and a file copy over an SSH channel you already permit does not look like one.
Seven sessions this week did not download their payload. They copied it in over SSH.
Outbound filtering is usually written around the web. Block the download, block the malware. That is the shape most rules have.
These sessions write a private key to a file, then use it to authenticate to an account on the attacker’s own machine and copy the payload down. We removed the key material and masked the host.
Only if that fails do they reach for the ordinary tools. The web download is the fallback, not the plan.
An encrypted file copy, over a protocol you deliberately allow, on a port you left open on purpose. Nothing in that sentence is what a download filter looks for.
The channel you trust most is the one worth watching. It is trusted because it is useful, which is exactly why it gets used.
Egress rules should cover every protocol that moves a file.
#linux#security#selfhosted#infosec#sysadmin
❯ Egress rules should cover every protocol that moves a file.