• Platformchevron right
  • Solutionschevron right
  • Modern NDRchevron right
  • Resourceschevron right
  • Companychevron right

DETECTION OVERVIEW

Unconventional Telnet Data Transfer

Risk Factors

While Telnet is an older and vulnerable protocol, it is often enabled by default. If an attacker gains access to a poorly-secured Telnet device, they can easily transfer data. Unusual data transfers can be associated with risky activity such as sharing malicious files between compromised devices or data staging. Data staging is the process of collecting and preparing data for exfiltration. Depending on the sensitivity of the transferred files, the impact can be devastating if important, proprietary, or customer data is leaked.

The system might change the risk score for this detection.

Kill Chain

Actions on Objective

Risk Score

60

Next in Actions on Objective: Unconventional VNC Data Transfer

Attack Background

N/A

Mitigation Options

Implement strict rules for outbound traffic on devices that contain valuable data

Track suspicious activity by implementing strict audit controls on important documents

Disable Telnet unless required

If you cannot disable Telnet, limit the number of login attempts and enforce a strong password policy

Configure a firewall to block untrusted IP addresses from accessing devices that have Telnet enabled

Implement strict access controls to devices that have Telnet enabled

MITRE ATT&CK ID

What else can RevealX do for you?