Sub-technique of T1048 Exfiltration Over Alternative Protocol.View on attack.mitre.org
Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Adversaries may opt to obfuscate this data, without the use of encryption, within network protocols that are natively unencrypted (such as HTTP, FTP, or DNS). This may include custom or publicly available encoding/compression algorithms (such as base64) as well as embedding data within protocol headers and fields.
Rules on DetectionCode tagged with T1048.003.
| Rule | Level | Log source |
|---|---|---|
| Suspicious WebDav Client Execution Via Rundll32.EXE | high | windows / process_creation |
| Data Exfiltration with Wget | medium | linux / NULL |
| PowerShell ICMP Exfiltration | medium | windows / ps_script |
| Python WebServer Execution - Linux | medium | linux / process_creation |
| Suspicious DNS Query with B64 Encoded String | medium | NULL / dns |
| Suspicious Outbound SMTP Connections | medium | windows / network_connection |
| WebDav Client Execution Via Rundll32.EXE | medium | windows / process_creation |
| WebDav Put Request | low | zeek / NULL |
| Used by | Procedure example |
|---|---|
| GroupAPT32 | APT32's backdoor can exfiltrate data by encoding it in the subdomain field of DNS packets. |
| GroupAPT33 | APT33 has used FTP to exfiltrate files (separately from the C2 channel). |
| GroupContagious Interview | Contagious Interview has exfiltrated victim information using FTP. |
| GroupFIN6 | FIN6 has sent stolen payment card data to remote servers via HTTP POSTs. |
| GroupFIN8 | FIN8 has used FTP to exfiltrate collected data. |
| GroupLazarus Group | Lazarus Group malware SierraBravo-Two generates an email message via SMTP containing information about newly infected victims. |
| GroupMustang Panda | Mustang Panda has used FTP to exfiltrate archive files. |
| GroupOilRig | OilRig has exfiltrated data via Microsoft Exchange and over FTP separately from its primary C2 channel over DNS. |
| Used by | Procedure example |
|---|---|
| MalwareAgent Tesla | Agent Tesla has routines for exfiltration over SMTP, FTP, and HTTP. |
| ToolBITSAdmin | BITSAdmin can be used to create BITS Jobs to upload files from a compromised host. |
| MalwareBrave Prince | Some Brave Prince variants have used South Korea's Daum email service to exfiltrate information, and later variants have posted the data to a web server via an HTTP post command. |
| MalwareCarbon | Carbon uses HTTP to send data to the C2 server. |
| Malwareccf32 | ccf32 can upload collected data and files to an FTP server. |
| MalwareCharmPower | CharmPower can send victim data via FTP with credentials hardcoded in the script. |
| MalwareCherry Picker | Cherry Picker exfiltrates files over FTP. |
| MalwareCookieMiner | CookieMiner has used the |
| Used by | Procedure example |
|---|---|
| Campaign2025 Poland Wiper Attacks | During the 2025 Poland Wiper Attacks, the adversaries exfiltrated data to an actor-controlled infrastructure using HTTP POSTs. |
| CampaignC0017 | During C0017, APT41 exfiltrated victim data via DNS lookups by encoding and prepending it as subdomains to the attacker-controlled domain. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
