Financial Theft T1657

Tactic: Impact

Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign types including extortion by ransomware, business email compromise (BEC) and fraud, "pig butchering," bank hacking, and exploiting cryptocurrency networks.

Authoring guide

These 3 rules share fields, values, and exclusions.

Fields filtered most (4 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
Provider_Name1eq 1s3.amazonaws.com
aws::errorCode1eq 1accessdenied
data_stream.dataset1eq 1aws.cloudtrail
tls.client.server_name1is_not_null 1

Top indicator values (3 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
Provider_Nameeq
s3.amazonaws.com
115
aws::errorCodeeq
accessdenied
116
data_stream.dataseteq
aws.cloudtrail
1169

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Elastic 1 rule

Kusto 2 rules