MITRE ATT&CKtechnique

T1041 Exfiltration Over C2 Channel

Published 2017-05-31 Modified 2026-09-11 Official page ↗
Domain
enterprise
Tactics
Exfiltration
Platforms
ESXi, Linux, macOS, Windows
Version
2.4
Created
2017-05-31

Description

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (2)

  • M1057 Data Loss Prevention mitigation
  • M1031 Network Intrusion Prevention mitigation

Referenced by MITRE ATT&CK · uses (211)

  • S9062 MiniBrowse software (malware)
  • S9063 DEEPROOT software (malware)
  • S9066 POLLBLEND software (malware)
  • S9067 TWOSTROKE software (malware)
  • S9059 MiniBike software (malware)
  • S9052 MiniFast software (malware)
  • S9050 Vidar software (malware)
  • S9043 Mini Shai-Hulud software (malware)
  • S9041 TeamPCP Cloud Stealer software (malware)
  • S9035 LAMEHUG software (malware)
  • G1055 VOID MANTICORE group
  • S9031 AshTag software (malware)
  • S9032 MuddyViper software (malware)
  • S9020 LODEINFO software (malware)
  • S9014 PHASEJAM software (malware)
  • S9015 BRICKSTORM software (malware)
  • S9008 Shai-Hulud software (malware)
  • S9007 HTTPTroy software (malware)
  • S1248 XORIndex Loader software (malware)
  • S1249 HexEval Loader software (malware)
  • G1052 Contagious Interview group
  • S1246 BeaverTail software (malware)
  • S1245 InvisibleFerret software (malware)
  • C0058 SharePoint ToolShell Exploitation campaign
  • S1240 RedLine Stealer software (malware)
  • C0056 RedPenguin campaign
  • S1213 Lumma Stealer software (malware)
  • S1210 Sagerunex software (malware)
  • C0049 Leviathan Australian Intrusions campaign
  • S1201 TRANSLATEXT software (malware)
Show all 211 ›

Referenced by Compliance · mitigates (21)

  • CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS Safeguard v8.1
  • CIS-3.13 Deploy a Data Loss Prevention Solution CIS Safeguard v8.1
  • CIS-4.4 Implement and Manage a Firewall on Servers CIS Safeguard v8.1
  • NIST-AC-16 Security and Privacy Attributes NIST 800-53 control
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-20 Use of External Systems NIST 800-53 control
  • NIST-AC-23 Data Mining Protection NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-3 Information Exchange NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SA-9 External System Services NIST 800-53 control
  • NIST-SC-13 Cryptographic Protection NIST 800-53 control
  • NIST-SC-28 Protection of Information at Rest NIST 800-53 control
  • NIST-SC-31 Covert Channel Analysis NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SR-4 Provenance NIST 800-53 control

References