Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Adversaries may also opt to encrypt and/or obfuscate these alternate channels.
Exfiltration Over Alternative Protocol can be done using various common operating system utilities such as Net/SMB or FTP.(Citation: Palo Alto OilRig Oct 2016) On macOS and Linux <code>curl</code> may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system.(Citation: 20 macOS Common Tools and Techniques)
Many IaaS and SaaS platforms (such as Microsoft Exchange, Microsoft SharePoint, GitHub, and AWS S3) support the direct download of files, emails, source code, and other sensitive information via the web console or Cloud API.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CIS-12.8 | Establish and Maintain Dedicated Computing Resources for All Administrative Work | mitigates | T1048 | Exfiltration Over Alternative Protocol |
Comments
Adversaries use alternate network protocols to transfer data outside the environment. Protocol-aware egress filtering and destination restrictions in the administrative enclave directly block unauthorized alternate-protocol exfiltration channels.
References
|
| CIS-12.2 | Establish and Maintain a Secure Network Architecture | mitigates | T1048 | Exfiltration Over Alternative Protocol |
Comments
Adversaries exfiltrate data using protocols other than their primary command-and-control channel. Protocol-aware egress and inter-zone controls restrict communications to approved protocols and destinations, directly blocking unauthorized alternate-protocol exfiltration paths.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1048 | Exfiltration Over Alternative Protocol |
Comments
Application proxies and gateways can require use of approved protocol services and restrict unauthorized application-layer protocols or destinations used for data exfiltration.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1048 | Exfiltration Over Alternative Protocol |
Comments
Network intrusion prevention solutions can use signatures for known adversary infrastructure, malware, and unusual protocol activity to block exfiltration over alternative protocols.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1048 | Exfiltration Over Alternative Protocol |
Comments
Enforce network segmentation, proxies, and dedicated protocol services so only approved systems can communicate over protocols such as DNS, reducing opportunities to exfiltrate data through alternative protocols.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1048 | Exfiltration Over Alternative Protocol |
Comments
Using role-based access control (RBAC) to limit user groups and roles for access to cloud storage systems and objects to only users with a legitimate need can help prevent adversaries from exfiltrating data from cloud storage.
References
|
| CIS-9.2 | Use DNS Filtering Services | mitigates | T1048 | Exfiltration Over Alternative Protocol |
Comments
DNS and other domain-based destinations may be used as alternative exfiltration channels. DNS filtering only impedes implementations that depend on resolving a known malicious domain.
References
|
| CIS-4.9 | Configure Trusted DNS Servers on Enterprise Assets | mitigates | T1048 | Exfiltration Over Alternative Protocol |
Comments
Enforcing use of trusted DNS resolvers reduces the ability of enterprise assets to communicate directly with adversary-controlled DNS infrastructure for exfiltration. The mitigation applies only to implementations that use DNS or depend on unauthorized DNS servers.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1048 | Exfiltration Over Alternative Protocol |
Comments
Restrictive outbound rules can prevent an endpoint from using unapproved protocols and ports for data exfiltration. The technique remains possible over protocols the organization must allow.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1048 | Exfiltration Over Alternative Protocol |
Comments
When outbound filtering is configured, a server firewall can block unauthorized protocols used to exfiltrate data. Effectiveness depends on whether egress rules are enforced rather than allowing unrestricted outbound traffic.
References
|
| CIS-3.13 | Deploy a Data Loss Prevention Solution | mitigates | T1048 | Exfiltration Over Alternative Protocol |
Comments
DLP is a direct control for blocking or alerting on exfiltration and data staging behaviors. DLP inspection capabilities may identify sensitive-data transfer across non-standard protocols.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1048 | Exfiltration Over Alternative Protocol |
Comments
Firewalls and access controls between production and non-production environments can permit only required protocols and destinations, blocking unauthorized alternate-protocol transfers across the production boundary.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| action.malware.variety.Export data | Export data to another site or system | related-to | T1048 | Exfiltration Over Alternative Protocol | |
| attribute.confidentiality.data_disclosure | Confirmed or potential data disclosure | related-to | T1048 | Exfiltration Over Alternative Protocol |
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| chrome_enterprise_premium | Chrome Enterprise Premium | technique_scores | T1048 | Exfiltration Over Alternative Protocol |
Comments
Chrome Enterprise Premium provides Data Loss Prevention (DLP) features that can detect and block sensitive data for files that are uploaded and downloaded and for content that is pasted or dragged and dropped via the Chrome browser. This can provide protection against adversaries that may try to steal data over network protocols.
References
|
| cloud_ids | Cloud IDS | technique_scores | T1048 | Exfiltration Over Alternative Protocol |
Comments
Often used by adversaries to compromise sensitive data, Palo Alto Network's spyware signatures is able to detect data exfiltration attempts over command and control communications.
Although there are ways an attacker could still exfiltrate data from a compromised system, this technique was scored as significant based on Palo Alto Network's advanced threat detection technology which constantly updates to detect against the latest known variations of these attacks.
References
|
| cloud_ngfw | Cloud Next-Generation Firewall (NGFW)_ | technique_scores | T1048 | Exfiltration Over Alternative Protocol |
Comments
Cloud NGFW can allow or deny traffic based on the traffic's protocol, destination ports, sources, and destinations. This functionality can be used to block adversaries from accessing resources from which to exfiltrate data as well as prevent resources from communicating with known-bad IP addresses and domains that might be used to receive exfiltrated data. This mapping is given a score of Partial because the known-bad IP addresses and domains would need to be known in advance and AWS Network Firewall wouldn't have deep packet inspection visibility into encrypted non-C2 protocols.
References
|
| google_secops | Google Security Operations | technique_scores | T1048 | Exfiltration Over Alternative Protocol |
Comments
Google Security Ops is able to trigger an alert based off suspicious system processes that could indicate exfiltration attempts using cURL from Windows machines (e.g., C:\\Windows\\System32\\curl.exe).
This technique was scored as minimal based on low or uncertain detection coverage factor.
https://github.com/chronicle/detection-rules/blob/783e0e5947774785db1c55041b70176deeca6f46/soc_prime_rules/threat_hunting/windows/suspicious_curl_usage.yaral
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| aws_iot_device_defender | AWS IoT Device Defender | technique_scores | T1048 | Exfiltration Over Alternative Protocol |
Comments
This control provides partial coverage for this technique and all of its sub-techniques, resulting in an overall score of Partial.
References
|
| aws_network_firewall | AWS Network Firewall | technique_scores | T1048 | Exfiltration Over Alternative Protocol |
Comments
AWS Network Firewall has the ability to pass, drop, or alert on traffic based on the network protocol as well as perform deep packet inspection on the payload. This functionality can be used to block adversaries from accessing resources from which to exfiltrate data as well as prevent resources from communicating with known-bad IP addresses and domains that might be used to receive exfiltrated data. This mapping is given a score of Partial because the known-bad IP addresses and domains would need to be known in advance and AWS Network Firewall wouldn't have deep packet inspection visibility into encrypted non-C2 protocols.
References
|
| amazon_guardduty | Amazon GuardDuty | technique_scores | T1048 | Exfiltration Over Alternative Protocol |
Comments
The following GuardDuty finding type flags events where adversaries may steal data by exfiltrating it over a different protocol than that of the existing command-and-control channel.
Trojan:EC2/DNSDataExfiltration Behavior:EC2/TrafficVolumeUnusual
References
|
| amazon_virtual_private_cloud | Amazon Virtual Private Cloud | technique_scores | T1048 | Exfiltration Over Alternative Protocol |
Comments
VPC security groups and network access control lists (NACLs) can limit access to external hosts and can therefore provide mitigation of this technique. For environments where Internet access is required, these controls can be used to block known malicious addresses. Because this latter protection is limited to known malicious endpoints, it provides Partial coverage resulting in an overall Partial score.
References
|
| Technique ID | Technique Name | Number of Mappings |
|---|---|---|
| T1048.001 | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | 12 |
| T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | 12 |
| T1048.003 | Exfiltration Over Unencrypted Non-C2 Protocol | 14 |