T1041
Exfiltration Over C2 Channel
ESXi · Linux · macOS · Windows4 pieces on this siteT1041 on attack.mitre.org
Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Data theft extortion response plan: verify the claim, find the way out, own the notification
An extortion demand with nothing encrypted, or your name on a leak site. Three questions run in parallel with three owners: is the claim real, what left and how, and what you are obliged to say and to whom. A plan for answering each one on evidence rather than on the attacker's framing.
An extortion demand, and nothing is encrypted
A message to staff, executives or a public address claiming to hold your data and demanding payment, often with a sample or a file listing, while every system is running normally.
The evidence it leaves
Where the traces live, and what each source proves and does not.
SRUM (System Resource Usage Monitor)
Zeek conn.log
how MITRE says to see it
Detection Strategy for Exfiltration Over C2 Channel
- Identifies suspicious outbound traffic volume mismatches from processes that typically do not generate network activity, particularly over C2 protocols like HTTPS, DNS, or custom TCP/UDP ports, following file or data access.
- Monitors for processes reading sensitive files then immediately initiating unusual outbound connections or bulk transfer sessions over persistent sockets, particularly with encrypted or binary payloads.
- Detects unauthorized applications or scripts accessing sensitive data followed by establishing encrypted outbound communication to rare external destinations or with abnormal byte ratios.
- Detects VMs sending outbound traffic through non-standard services or to unknown destinations. Exfiltration over reverse shells tunneled via VMkernel or custom payloads routed via hostd/vpxa.
what reduces it
- M1031 Network Intrusion Prevention. Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions.
- M1057 Data Loss Prevention. Data loss prevention can detect and block sensitive data being sent over unencrypted protocols.