MITRE ATT&CKsub-technique

T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

Published 2020-03-15 Modified 2026-09-03 Official page ↗
Domain
enterprise
Tactics
Exfiltration
Platforms
ESXi, Linux, macOS, Network Devices, Windows
Version
2.2
Created
2020-03-15

Description

Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Adversaries may opt to obfuscate this data, without the use of encryption, within network protocols that are natively unencrypted (such as HTTP, FTP, or DNS). This may include custom or publicly available encoding/compression algorithms (such as base64) as well as embedding data within protocol headers and fields.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1048 Exfiltration Over Alternative Protocol technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (4)

  • M1057 Data Loss Prevention mitigation
  • M1037 Filter Network Traffic mitigation
  • M1030 Network Segmentation mitigation
  • M1031 Network Intrusion Prevention mitigation

Referenced by MITRE ATT&CK · uses (35)

  • C0063 2025 Poland Wiper Attacks campaign
  • G1052 Contagious Interview group
  • S1245 InvisibleFerret software (malware)
  • S1228 PUBLOAD software (malware)
  • G1045 Salt Typhoon group
  • S1124 SocGholish software (malware)
  • S1116 WARPWIRE software (malware)
  • C0017 C0017 campaign
  • S1043 ccf32 software (malware)
  • S1040 Rclone software (tool)
  • S0674 CharmPower software (malware)
  • G0129 Mustang Panda group
  • S0492 CookieMiner software (malware)
  • S0487 Kessel software (malware)
  • S0466 WindTail software (malware)
  • G0102 Wizard Spider group
  • S0428 PoetRAT software (malware)
  • S0356 KONNI software (malware)
  • S0331 Agent Tesla software (malware)
  • S0335 Carbon software (malware)
  • G0076 Thrip group
  • S0252 Brave Prince software (malware)
  • S0281 Dok software (malware)
  • G0061 FIN8 group
  • G0064 APT33 group
  • S0190 BITSAdmin software (tool)
  • S0212 CORALDECK software (malware)
  • G0049 OilRig group
  • G0050 APT32 group
  • G0032 Lazarus Group group
Show all 35 ›

Referenced by Compliance · mitigates (32)

  • CIS-12.2 Establish and Maintain a Secure Network Architecture CIS Safeguard v8.1
  • CIS-13.10 Perform Application Layer Filtering CIS Safeguard v8.1
  • CIS-13.4 Perform Traffic Filtering Between Network Segments CIS Safeguard v8.1
  • CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS Safeguard v8.1
  • CIS-16.8 Separate Production and Non-Production Systems CIS Safeguard v8.1
  • CIS-4.4 Implement and Manage a Firewall on Servers CIS Safeguard v8.1
  • CIS-4.5 Implement and Manage a Firewall on End-User Devices CIS Safeguard v8.1
  • CIS-4.9 Configure Trusted DNS Servers on Enterprise Assets CIS Safeguard v8.1
  • CIS-9.2 Use DNS Filtering Services CIS Safeguard v8.1
  • NIST-AC-16 Security and Privacy Attributes NIST 800-53 control
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-20 Use of External Systems NIST 800-53 control
  • NIST-AC-23 Data Mining Protection NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-3 Information Exchange NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SA-9 External System Services NIST 800-53 control
  • NIST-SC-13 Cryptographic Protection NIST 800-53 control
  • NIST-SC-28 Protection of Information at Rest NIST 800-53 control
  • NIST-SC-31 Covert Channel Analysis NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-10 Information Input Validation NIST 800-53 control
  • NIST-SI-15 Information Output Filtering NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
Show all 32 ›

References