Exfiltration Over Alternative Protocol

T1048

Technique with 3 sub-techniques.View on attack.mitre.org

About this technique

Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.

Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Adversaries may also opt to encrypt and/or obfuscate these alternate channels.

Exfiltration Over Alternative Protocol can be done using various common operating system utilities such as Net/SMB or FTP. On macOS and Linux curl may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system.

Many IaaS and SaaS platforms (such as Microsoft Exchange, Microsoft SharePoint, GitHub, and AWS S3) support the direct download of files, emails, source code, and other sensitive information via the web console or Cloud API.

Detection rules37

Rules on DetectionCode tagged with T1048 or one of its sub-techniques.

Sigma18

Rule	Level	Log source	Technique
DNS Exfiltration and Tunneling Tools Execution	high	windows / process_creation	T1048.001
Powershell DNSExfiltration	high	windows / ps_script	T1048
PUA - Restic Backup Tool Execution	high	windows / process_creation	T1048
Suspicious Redirection to Local Admin Share	high	windows / process_creation	T1048
Suspicious WebDav Client Execution Via Rundll32.EXE	high	windows / process_creation	T1048.003
Copy From Or To Admin Share Or Sysvol Folder	medium	windows / process_creation	T1048
Data Exfiltration with Wget	medium	linux / NULL	T1048.003
Data Export From MSSQL Table Via BCP.EXE	medium	windows / process_creation	T1048
DNS TOR Proxies	medium	zeek / NULL	T1048
PowerShell ICMP Exfiltration	medium	windows / ps_script	T1048.003
Python WebServer Execution - Linux	medium	linux / process_creation	T1048.003
Suspicious DNS Query with B64 Encoded String	medium	NULL / dns	T1048.003
Suspicious Outbound SMTP Connections	medium	windows / network_connection	T1048.003
Tap Driver Installation	medium	windows / NULL	T1048
Tap Installer Execution	medium	windows / process_creation	T1048
WebDav Client Execution Via Rundll32.EXE	medium	windows / process_creation	T1048.003
Tap Driver Installation - Security	low	windows / NULL	T1048
WebDav Put Request	low	zeek / NULL	T1048.003

Splunk19

Rule	Type	Risk	Data source	Technique
Cisco ASA - Device File Copy to Remote Location	Anomaly	NULL	Cisco ASA Logs	T1048.003
Cisco Secure Firewall - Potential Data Exfiltration	Anomaly	NULL	Cisco Secure Firewall Threat Defense Connection Event	T1048.003
Clients Connecting to Multiple DNS Servers	TTP	NULL		T1048.003
Detect DNS Data Exfiltration using pretrained model in DSDL	Anomaly	NULL		T1048.003
Detect Long DNS TXT Record Response	TTP	NULL		T1048.003
Detection of DNS Tunnels	TTP	NULL		T1048.003
DNS Exfiltration Using Nslookup App	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1048
DNS Query Length With High Standard Deviation	Anomaly	NULL	Sysmon EventID 22	T1048.003
Excessive Usage of NSLOOKUP App	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1048
Gsuite Outbound Email With Attachment To External Domain	Hunting	NULL	G Suite Gmail	T1048.003
Linux Shell Pseudo Device Reverse Shell	Anomaly	NULL	Sysmon for Linux EventID 1	T1048.003
Multiple Archive Files Http Post Traffic	TTP	NULL	Splunk Stream HTTP	T1048.003
O365 DLP Rule Triggered	Anomaly	NULL	Office 365 Universal Audit Log	T1048
Ollama Possible Model Exfiltration Data Leakage	Anomaly	NULL	Ollama Server	T1048
Plain HTTP POST Exfiltrated Data	TTP	NULL	Splunk Stream HTTP	T1048.003
Prohibited Network Traffic Allowed	Anomaly	NULL	Cisco Secure Firewall Threat Defense Connection Event	T1048
Protocol or Port Mismatch	Anomaly	NULL	Cisco Secure Firewall Threat Defense Connection Event	T1048.003
Windows Rundll32 WebDAV Request	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1048.003
Windows Rundll32 WebDav With Network Connection	TTP	NULL	Sysmon EventID 1 AND Sysmon EventID 3	T1048.003

Sub-techniques3

ID	Name	Examples
T1048.001	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	0
T1048.002	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	8
T1048.003	Exfiltration Over Unencrypted Non-C2 Protocol	35

Groups2

Play TeamTNT

Software7

AADInternals Bundlore Chaes FrameworkPOS Hydraq Kobalos PoetRAT

Campaigns0

None recorded.

Procedure examples9

Groups2

Used by	Procedure example
GroupPlay	Play has used WinSCP to exfiltrate data to actor-controlled accounts. CISA Play Ransomware Advisory December 2023 Trend Micro Ransomware Spotlight Play July 2023
GroupTeamTNT	TeamTNT has sent locally staged files with collected credentials to C2 servers using cURL. Cisco Talos Intelligence Group

Software7

Used by	Procedure example
ToolAADInternals	AADInternals can directly download cloud user data such as OneDrive files. AADInternals Documentation
MalwareBundlore	Bundlore uses the `curl -s -L -o` command to exfiltrate archived data to a URL. 20 macOS Common Tools and Techniques
MalwareChaes	Chaes has exfiltrated its collected data from the infected machine to the C2, sometimes using the MIME protocol. Cybereason Chaes Nov 2020
MalwareFrameworkPOS	FrameworkPOS can use DNS tunneling for exfiltration of credit card data. SentinelOne FrameworkPOS September 2019
MalwareHydraq	Hydraq connects to a predefined domain on port 443 to exfil gathered information. Symantec Hydraq Jan 2010
MalwareKobalos	Kobalos can exfiltrate credentials over the network via UDP. ESET Kobalos Jan 2021
MalwarePoetRAT	PoetRAT has used a .NET tool named dog.exe to exiltrate information over an e-mail account. Talos PoetRAT April 2020

References2

20 macOS Common Tools and Techniques Open source
Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.
Palo Alto OilRig Oct 2016 Open source
Grunzweig, J. and Falcone, R.. (2016, October 4). OilRig Malware Campaign Updates Toolset and Expands Targets. Retrieved May 3, 2017.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.