Cross-source coverage

T1048.003 / ATT&CK

Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol

25 rules across 4 sources.

1 atomic-IOC hidden · include

From MITRE ATT&CK 19.2

Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.

Adversaries may opt to obfuscate this data, without the use of encryption, within network protocols that are natively unencrypted (such as HTTP, FTP, or DNS). This may include custom or publicly available encoding/compression algorithms (such as base64) as well as embedding data within protocol headers and fields.

Tactics: Exfiltration
Platforms: ESXi · Linux · macOS · Network Devices · Windows
Telemetry: WinEventLog:SysmonWinEventLog:SecurityNSM:Flowauditd:SYSCALLmacos:osquerymacos:unifiedlogesxi:hostdnetworkdevice:clinetworkdevice:syslog

How MITRE says to detect it DET0149

Detection of Exfiltration Over Unencrypted Non-C2 Protocol

Windows Analytic 0423

Detects data access or staging events followed by outbound data flows using unencrypted protocols (e.g., FTP, HTTP) initiated by unexpected processes or to rare destinations.

WinEventLog:Sysmon EventCode=3, 22
WinEventLog:Sysmon EventCode=1
WinEventLog:Security EventCode=4663, 4670, 4656
NSM:Flow http.log, ftp.log

Linux Analytic 0424

Detects file access or compression utilities followed by outbound connections using curl, wget, ftp, or custom binaries communicating over unencrypted protocols.

auditd:SYSCALL execve
auditd:SYSCALL connect
NSM:Flow http.log, ftp.log
NSM:Flow flow records

macOS Analytic 0425

Detects abnormal outbound HTTP/FTP connections by local scripts or binaries outside of standard browser activity, following access to local documents or user data.

macos:osquery socket_events
macos:osquery process_events
macos:unifiedlog log stream - file subsystem
NSM:Flow http.log, ftp.log

ESXi Analytic 0426

Detects shell-based scripts accessing configuration files or snapshots and transmitting them over unencrypted protocols such as FTP or HTTP to non-management IPs.

esxi:hostd event stream
NSM:Flow flow records
NSM:Flow http.log

Network Devices Analytic 0427

Detects use of unencrypted protocols (e.g., TFTP, FTP, HTTP) to transfer configuration files, routing tables, or logs to untrusted IP addresses, especially using administrative commands like `copy run ftp:`.

networkdevice:cli CLI command logs
networkdevice:syslog flow records
NSM:Flow PCAP inspection

View on attack.mitre.org ↗

splunk/security_content

10 rules

Detection	Severity	Format
Cisco ASA - Device File Copy to Remote Location	Undefined	SPL
Cisco Secure Firewall - Potential Data Exfiltration	Undefined	SPL
DNS Query Length With High Standard Deviation	Undefined	SPL
Gsuite Outbound Email With Attachment To External Domain	Undefined	SPL
Linux Shell Pseudo Device Reverse Shell	Undefined	SPL
Multiple Archive Files Http Post Traffic	Undefined	SPL
Plain HTTP POST Exfiltrated Data	Undefined	SPL
Protocol or Port Mismatch	Undefined	SPL
Windows Rundll32 WebDAV Request	Undefined	SPL
Windows Rundll32 WebDav With Network Connection	Undefined	SPL

SigmaHQ/sigma

8 rules

Detection	Severity	Format
Suspicious WebDav Client Execution Via Rundll32.EXE	High	Sigma
Data Exfiltration with Wget	Medium	Sigma
Potential Data Exfiltration Over SMTP Via Send-MailMessage Cmdlet	Medium	Sigma
PowerShell ICMP Exfiltration	Medium	Sigma
Python WebServer Execution - Linux	Medium	Sigma
Suspicious Outbound SMTP Connections	Medium	Sigma
WebDav Client Execution Via Rundll32.EXE	Medium	Sigma
WebDav Put Request	Low	Sigma

elastic/detection-rules

4 rules

Detection	Severity	Format
File Transfer or Listener Established via Netcat	Medium	Elastic TOML
Netcat File Transfer or Listener Detected via Defend for Containers	Medium	Elastic TOML
Potential Data Exfiltration Through Curl	Medium	Elastic TOML
Potential DNS Exfiltration via Excessive Chunked Queries	Medium	Elastic TOML

socfortress/Wazuh-Rules

3 rules

Detection	Severity	Format
Possible DNS-based data exfiltration using hex-encoded subdomain (T1048.003)	High	Wazuh XML
Python HTTP server launched on suspicious port (T1048.003 - Exfiltration Over Alt Protocol)	High	Wazuh XML
File download from HTTP server on port 1337 (Potential Exfiltration - T1048.003)	Medium	Wazuh XML