T1048.003Exfiltration
Exfiltration Over Unencrypted Non-C2 Protocol
Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Adversaries may opt to obfuscate this data, without the use of encryption, within network protocols that are natively unencrypted (such as HTTP, FTP, or…
CVEs1
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.1
Reports0
Detections
9 Sigma rules tagged T1048.003Exfiltration Over Unencrypted Non-C2 ProtocolT1048.0039 general rules
- Suspicious WebDav Client Execution Via Rundll32.EXEhightest
- Data Exfiltration with Wgetmediumtest
- Potential Data Exfiltration Over SMTP Via Send-MailMessage Cmdletmediumtest
- PowerShell ICMP Exfiltrationmediumtest
- Suspicious DNS Query with B64 Encoded Stringmediumtest
- Suspicious Outbound SMTP Connectionsmediumtest
- WebDav Client Execution Via Rundll32.EXEmediumtest
- Python WebServer Execution - Linuxmediumexperimental
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Exfiltration Over Unencrypted Non-C2 Protocol
1 CVE, by priority. Each link shows its badge.- CVE-2021-34473Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft · Exchange ServerKEVRansomwarePublic exploitCritical · 9.1T1190Exploit Public-Facing ApplicationT1053.005Scheduled Task+3 more · 9 reportsMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.01%89.4priority