T1048.003sub-technique of T1048 Exfiltration Over Alternative Protocol
Exfiltration Over Unencrypted Non-C2 Protocol
ESXi · Linux · macOS · Network Devices · Windows3 pieces on this siteT1048.003 on attack.mitre.org
Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Adversaries may opt to obfuscate this data, without the use of encryption, within network protocols that are natively unencrypted (such as HTTP, FTP, or DNS).
If this is happening now
Checklists and playbooks to open while the alert is still live.
Suspected data theft by an insider
A resignation with unusual file access, a DLP alert, or an unexplained large transfer.
Detect it
Hunts and rules you can run, each stating what it needs and what else it returns.
Sigma network pack: four rules for DNS, proxy and firewall logs
Long DNS labels, scripting-engine user agents at the proxy, executables fetched from a bare IP address, and SMB leaving the network. Written for the log sources most estates already collect and rarely alert on.
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
DNS with something in the labels: a small constructed capture
Sixty DNS queries from one workstation, fifteen of them TXT lookups whose first label is 56 characters of base32. Small enough to read packet by packet, and generated by a script, so nothing in it came from a real network.
Read
Analyses, case studies, guides, references and interview questions.
Finding DNS tunnelling in a 4 GB capture without a signature
Entropy, subdomain cardinality and query-rate shape. Three statistics that find a covert channel faster than any rule matching a known tool.
how MITRE says to see it
Detection of Exfiltration Over Unencrypted Non-C2 Protocol
- Detects data access or staging events followed by outbound data flows using unencrypted protocols (e.g., FTP, HTTP) initiated by unexpected processes or to rare destinations.
- Detects file access or compression utilities followed by outbound connections using curl, wget, ftp, or custom binaries communicating over unencrypted protocols.
- Detects abnormal outbound HTTP/FTP connections by local scripts or binaries outside of standard browser activity, following access to local documents or user data.
- Detects shell-based scripts accessing configuration files or snapshots and transmitting them over unencrypted protocols such as FTP or HTTP to non-management IPs.
what reduces it
- M1031 Network Intrusion Prevention. Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary command and control infrastructure and malware can be used to mitigate activity at the network level.
- M1037 Filter Network Traffic. Enforce proxies and use dedicated servers for services such as DNS and only allow those systems to communicate over respective ports/protocols, instead of all systems within a network.
- M1057 Data Loss Prevention. Data loss prevention can detect and block sensitive data being sent over unencrypted protocols.
- M1030 Network Segmentation. Follow best practices for network firewall configurations to allow only necessary ports and traffic to enter and exit the network.