Cross-source coverage

T1048 / ATT&CK

Exfiltration Over Alternative Protocol

97 rules · 95 families across 10 sources.

5 deprecated hidden · include 9 atomic-IOC hidden · include

From MITRE ATT&CK 19.2

Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.

Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Adversaries may also opt to encrypt and/or obfuscate these alternate channels.

Exfiltration Over Alternative Protocol can be done using various common operating system utilities such as Net/SMB or FTP. On macOS and Linux curl may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system.

Many IaaS and SaaS platforms (such as Microsoft Exchange, Microsoft SharePoint, GitHub, and AWS S3) support the direct download of files, emails, source code, and other sensitive information via the web console or Cloud API.

Tactics: Exfiltration
Platforms: ESXi · IaaS · Linux · macOS · Network Devices · Office Suite · SaaS · Windows
Telemetry: WinEventLog:SysmonWinEventLog:Securityauditd:SYSCALLNSM:Flowmacos:unifiedlogmacos:osqueryAWS:CloudTrailAWS:VPCFlowLogsesxi:hostdesxi:vmkernel

How MITRE says to detect it DET0131

Behavioral Detection Strategy for Exfiltration Over Alternative Protocol

Windows Analytic 0367

Detects unusual outbound file transfer behavior using protocols like FTP, SMB, SMTP, or DNS, involving non-standard processes, off-hour activity, or uncommonly high volume.

WinEventLog:Sysmon EventCode=3, 22
WinEventLog:Sysmon EventCode=11
WinEventLog:Security EventCode=4688

Linux Analytic 0368

Detects file exfiltration using tools like curl, scp, or custom binaries over protocols such as FTP, HTTP/S, or DNS tunneling, especially outside baseline user behavior.

auditd:SYSCALL execve
auditd:SYSCALL connect
auditd:SYSCALL open
auditd:SYSCALL write
NSM:Flow NetFlow/Zeek conn.log

macOS Analytic 0369

Detects non-native file transfer via curl, Python scripts, or AppleScript using uncommon protocols like FTP, SMTP, or DNS exfiltration through mDNSResponder abuse.

macos:unifiedlog log stream (subsystem: com.apple.system.networking)
macos:osquery process_events
macos:osquery file_events

IaaS Analytic 0370

Detects access to cloud APIs or CLI tools to move or sync files from sensitive buckets to external endpoints using protocols like HTTPS or S3 APIs.

AWS:CloudTrail GetObject, CopyObject
AWS:VPCFlowLogs Outbound data flows

ESXi Analytic 0371

Detects outbound traffic from hostd/vpxa or guest VM interfaces using unauthorized protocols such as FTP, HTTP POST bursts, or long-lived DNS tunnels.

esxi:hostd logline inspection
esxi:vmkernel protocol egress

View on attack.mitre.org ↗

Sub-techniques with coverage

Counted in the 97 above — a rule tagged a sub-technique covers this technique too.

elastic/detection-rules

22 rules

Detection	Severity	Format
File Transfer or Listener Established via Netcat	Medium	Elastic TOML
File Transfer Utility Launched from Unusual Parent	Medium	Elastic TOML
LLM-Based Curl Activity Triage	Medium	Elastic TOML
LLM-Based Curl Activity Triage via Auditd	Medium	Elastic TOML
LLM-Based Wget Activity Triage	Medium	Elastic TOML
LLM-Based Wget Activity Triage via Auditd	Medium	Elastic TOML
Netcat File Transfer or Listener Detected via Defend for Containers	Medium	Elastic TOML
Network Activity Detected via cat	Medium	Elastic TOML
Potential Data Exfiltration Through Curl	Medium	Elastic TOML
Potential Data Exfiltration Through Wget	Medium	Elastic TOML

+ 12 more from elastic/detection-rules → showing the 10 highest-severity

socfortress/Wazuh-Rules

22 rules · 21 families

Detection	Severity	Format
Detects a curl process start on linux, which indicates a file pushed to a remote server.	High	Wazuh XML
Detects attempts to post the file with the usage of wget utility. The adversary can bypass the permission restriction with the misconfigured sudo permission for wget utility which could allow them to read files like /etc/shadow. 2 variants	High	Wazuh XML
Detects attempts to post the file with the usage of wget utility. The adversary can bypass the permission restriction with the misconfigured sudo permission for wget utility which could allow them to read files like /etc/shadow. 2 variants	High	Wazuh XML
Possible DNS-based data exfiltration using hex-encoded subdomain (T1048.003)	High	Wazuh XML
Python HTTP server launched on suspicious port (T1048.003 - Exfiltration Over Alt Protocol)	High	Wazuh XML
Sysmon - Event 1: Process creation · curl.exe file upload to HTTPS (T1048.002)	High	Wazuh XML
Sysmon - Event 1: Process creation · dig DNS Exfil (T1048.003)	High	Wazuh XML
Sysmon - Event 1: Process creation · dig DNS Exfiltration (T1048)	High	Wazuh XML
Sysmon - Event 1: Process creation · DNSExfiltrator PowerShell (T1048)	High	Wazuh XML
Sysmon - Event 1: Process creation · Exfiltration via SSH (T1048)	High	Wazuh XML

+ 12 more from socfortress/Wazuh-Rules → showing the 10 highest-severity

SigmaHQ/sigma

19 rules

Detection	Severity	Format
DNS Exfiltration and Tunneling Tools Execution	High	Sigma
Powershell DNSExfiltration	High	Sigma
PUA - Restic Backup Tool Execution	High	Sigma
Suspicious Redirection to Local Admin Share	High	Sigma
Suspicious WebDav Client Execution Via Rundll32.EXE	High	Sigma
Copy From Or To Admin Share Or Sysvol Folder	Medium	Sigma
Data Exfiltration with Wget	Medium	Sigma
Data Export From MSSQL Table Via BCP.EXE	Medium	Sigma
FTP Connection Open Attempt Via Winscp CLI	Medium	Sigma
Potential Data Exfiltration Over SMTP Via Send-MailMessage Cmdlet	Medium	Sigma

+ 9 more from SigmaHQ/sigma → showing the 10 highest-severity

splunk/security_content

15 rules

Detection	Severity	Format
Cisco ASA - Device File Copy to Remote Location	Undefined	SPL
Cisco Secure Firewall - Potential Data Exfiltration	Undefined	SPL
DNS Exfiltration Using Nslookup App	Undefined	SPL
DNS Query Length With High Standard Deviation	Undefined	SPL
Excessive Usage of NSLOOKUP App	Undefined	SPL
Gsuite Outbound Email With Attachment To External Domain	Undefined	SPL
Linux Shell Pseudo Device Reverse Shell	Undefined	SPL
Multiple Archive Files Http Post Traffic	Undefined	SPL
O365 DLP Rule Triggered	Undefined	SPL
Ollama Possible Model Exfiltration Data Leakage	Undefined	SPL

+ 5 more from splunk/security_content → showing the 10 highest-severity

chronicle/detection-rules

4 rules

Detection	Severity	Format
o365_onedrive_anonymous_file_accessed	Medium	YARA-L
o365_onedrive_anonymous_filedownload	Medium	YARA-L
o365_onedrive_anonymous_link_accessed	Medium	YARA-L
o365_file_download	Low	YARA-L

elastic/protections-artifacts

4 rules

Detection	Severity	Format
Potential Data Exfiltration Through Wget	Undefined	Elastic TOML
Potential Data Exfiltration via Curl	Undefined	Elastic TOML
Sensitive File Access via Rsync	Undefined	Elastic TOML
User Keychain Exfiltration via Curl	Undefined	Elastic TOML

Emerging Threats Open

3 rules

Detection	Severity	Format
ET MALWARE JS ZimReaper C2 DNS-label Exfiltration in DNS Lookup	High	Suricata
ET MALWARE JS ZimReaper C2 DNS-label Exfiltration in TLS SNI	High	Suricata
ET MALWARE JS ZimReaper C2 DNS-label pixel Exfiltration over HTTP	High	Suricata

Wazuh Core Ruleset

3 rules

Detection	Severity	Format
Amazon Security Lake - Amazon VPC rules grouped.	Low	Wazuh XML
Amazon Security Lake - CloudTrail rules grouped.	Low	Wazuh XML
Amazon Security Lake - Route 53 rules grouped.	Low	Wazuh XML

panther-labs/panther-analysis

3 rules

Detection	Severity	Format
External Principal Accessing AWS Resources Via VPC Endpoint	Medium	Panther Python
Azure Storage File Share Created or Modified	Informational	Panther Python
EC2 Route Table Modified	Informational	Panther Python

Azure/Azure-Sentinel

2 rules

Detection	Severity	Format
DNS events related to ToR proxies (ASIM DNS Schema)	Low	KQL
RareDNSLookupWithDataTransfer	Undefined	KQL