T1048Exfiltration

Exfiltration Over Alternative Protocol

Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Adversaries may also opt to…

attack.mitre.org ↗

CVEs4

In 4

Reports0

Sub-techniques T1048.001Exfiltration Over Symmetric Encrypted Non-C2 Protocol T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol T1048.003Exfiltration Over Unencrypted Non-C2 Protocol1

Detections

12 Sigma rules tagged T1048

Exfiltration Over Alternative ProtocolT104812 general rules

Powershell DNSExfiltrationhightest
Suspicious Redirection to Local Admin Sharehightest
PUA - Restic Backup Tool Executionhighexperimental
Copy From Or To Admin Share Or Sysvol Foldermediumtest
Data Export From MSSQL Table Via BCP.EXEmediumtest
DNS TOR Proxiesmediumtest
Tap Driver Installationmediumtest
Tap Installer Executionmediumtest

All 12 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

CVEs linked to Exfiltration Over Alternative Protocol

4 CVEs, by priority. Each link shows its badge.

CVE-2022-26501Veeam Backup & Replication Remote Code Execution Vulnerability
Veeam · Backup & ReplicationKEVRansomwareCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter+2 more
MITRE CTID mapping of the KEV entry · follow-on activity
4.1%Top 9.3%
73.0priority
CVE-2022-26500Veeam Backup & Replication Remote Code Execution Vulnerability
Veeam · Backup & ReplicationKEVRansomwareHigh · 8.8T1078Valid Accounts T1190Exploit Public-Facing Application+3 more
MITRE CTID mapping of the KEV entry · follow-on activity
5.8%Top 6.9%
72.8priority
CVE-2017-6742Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
Cisco · IOS and IOS XE SoftwareKEVPublic exploitHigh · 8.8T1574Hijack Execution Flow T1059Command and Scripting Interpreter+2 more
MITRE CTID mapping of the KEV entry · follow-on activity
21.4%Top 2.4%
68.7priority
CVE-2013-0641Adobe Reader Buffer Overflow Vulnerability
Adobe · ReaderKEVEnd of lifeHigh · 7.8T1204.002Malicious File T1105Ingress Tool Transfer+1 more · 1 report
MITRE CTID mapping of the KEV entry · follow-on activity
32.3%Top 1.7%
52.0priority

Linked through a sub-technique

1 more

CVE-2021-34473Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Exchange ServerKEVRansomwarePublic exploitCritical · 9.1T1190Exploit Public-Facing Application T1053.005Scheduled Task+3 more · 9 reports
>99.9%Top 0.01%
89.4priority