MITRE ATT&CKtechnique

T1048 Exfiltration Over Alternative Protocol

Published 2017-05-31 Modified 2026-09-03 Official page ↗
Domain
enterprise
Tactics
Exfiltration
Platforms
ESXi, IaaS, Linux, macOS, Network Devices, Office Suite, SaaS, Windows
Version
1.6
Created
2017-05-31

Description

Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Adversaries may also opt to encrypt and/or obfuscate these alternate channels. Exfiltration Over Alternative Protocol can be done using various common operating system utilities such as Net/SMB or FTP. On macOS and Linux curl may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system. Many IaaS and SaaS platforms (such as Microsoft Exchange, Microsoft SharePoint, GitHub, and AWS S3) support the direct download of files, emails, source code, and other sensitive information via the web console or Cloud API.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (6)

  • M1057 Data Loss Prevention mitigation
  • M1037 Filter Network Traffic mitigation
  • M1030 Network Segmentation mitigation
  • M1031 Network Intrusion Prevention mitigation
  • M1018 User Account Management mitigation
  • M1022 Restrict File and Directory Permissions mitigation

Referenced by MITRE ATT&CK · subtechnique of (3)

  • T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol sub-technique
  • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol sub-technique
  • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol sub-technique

Referenced by MITRE ATT&CK · uses (9)

  • G1040 Play group
  • S0677 AADInternals software (tool)
  • G0139 TeamTNT group
  • S0641 Kobalos software (malware)
  • S0631 Chaes software (malware)
  • S0503 FrameworkPOS software (malware)
  • S0482 Bundlore software (malware)
  • S0428 PoetRAT software (malware)
  • S0203 Hydraq software (malware)

Referenced by Compliance · mitigates (35)

  • CIS-12.2 Establish and Maintain a Secure Network Architecture CIS Safeguard v8.1
  • CIS-12.8 Establish and Maintain Dedicated Computing Resources for All Administrative Work CIS Safeguard v8.1
  • CIS-13.10 Perform Application Layer Filtering CIS Safeguard v8.1
  • CIS-13.4 Perform Traffic Filtering Between Network Segments CIS Safeguard v8.1
  • CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS Safeguard v8.1
  • CIS-16.8 Separate Production and Non-Production Systems CIS Safeguard v8.1
  • CIS-3.13 Deploy a Data Loss Prevention Solution CIS Safeguard v8.1
  • CIS-4.4 Implement and Manage a Firewall on Servers CIS Safeguard v8.1
  • CIS-4.5 Implement and Manage a Firewall on End-User Devices CIS Safeguard v8.1
  • CIS-4.9 Configure Trusted DNS Servers on Enterprise Assets CIS Safeguard v8.1
  • CIS-6.8 Define and Maintain Role-Based Access Control CIS Safeguard v8.1
  • CIS-9.2 Use DNS Filtering Services CIS Safeguard v8.1
  • NIST-AC-16 Security and Privacy Attributes NIST 800-53 control
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-20 Use of External Systems NIST 800-53 control
  • NIST-AC-23 Data Mining Protection NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-3 Information Exchange NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SA-9 External System Services NIST 800-53 control
  • NIST-SC-28 Protection of Information at Rest NIST 800-53 control
  • NIST-SC-31 Covert Channel Analysis NIST 800-53 control
  • NIST-SC-46 Cross Domain Policy Enforcement NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
Show all 35 ›

References