Home
ATT&CK Techniques
T1048 Exfiltration Over Alternative Protocol

T1048 Exfiltration Over Alternative Protocol Mappings

Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.

Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Adversaries may also opt to encrypt and/or obfuscate these alternate channels.

Exfiltration Over Alternative Protocol can be done using various common operating system utilities such as Net/SMB or FTP.(Citation: Palo Alto OilRig Oct 2016) On macOS and Linux <code>curl</code> may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system.(Citation: 20 macOS Common Tools and Techniques)

Many IaaS and SaaS platforms (such as Microsoft Exchange, Microsoft SharePoint, GitHub, and AWS S3) support the direct download of files, emails, source code, and other sensitive information via the web console or Cloud API.

View in MITRE ATT&CK®

Mappings

Capability ID	Capability Description	Mapping Type	ATT&CK ID	ATT&CK Name
AC-16	Security and Privacy Attributes	Protects	T1048	Exfiltration Over Alternative Protocol
AC-02	Account Management	Protects	T1048	Exfiltration Over Alternative Protocol
AC-20	Use of External Systems	Protects	T1048	Exfiltration Over Alternative Protocol
AC-23	Data Mining Protection	Protects	T1048	Exfiltration Over Alternative Protocol
AC-03	Access Enforcement	Protects	T1048	Exfiltration Over Alternative Protocol
AC-04	Information Flow Enforcement	Protects	T1048	Exfiltration Over Alternative Protocol
AC-06	Least Privilege	Protects	T1048	Exfiltration Over Alternative Protocol
CA-03	Information Exchange	Protects	T1048	Exfiltration Over Alternative Protocol
CA-07	Continuous Monitoring	Protects	T1048	Exfiltration Over Alternative Protocol
CM-02	Baseline Configuration	Protects	T1048	Exfiltration Over Alternative Protocol
CM-06	Configuration Settings	Protects	T1048	Exfiltration Over Alternative Protocol
CM-07	Least Functionality	Protects	T1048	Exfiltration Over Alternative Protocol
SA-08	Security and Privacy Engineering Principles	Protects	T1048	Exfiltration Over Alternative Protocol
SA-09	External System Services	Protects	T1048	Exfiltration Over Alternative Protocol
SC-28	Protection of Information at Rest	Protects	T1048	Exfiltration Over Alternative Protocol
SC-31	Covert Channel Analysis	Protects	T1048	Exfiltration Over Alternative Protocol
SC-46	Cross Domain Policy Enforcement	Protects	T1048	Exfiltration Over Alternative Protocol
SC-07	Boundary Protection	Protects	T1048	Exfiltration Over Alternative Protocol
SI-10	Information Input Validation	Protects	T1048	Exfiltration Over Alternative Protocol
SI-15	Information Output Filtering	Protects	T1048	Exfiltration Over Alternative Protocol
SI-03	Malicious Code Protection	Protects	T1048	Exfiltration Over Alternative Protocol
SI-04	System Monitoring	Protects	T1048	Exfiltration Over Alternative Protocol
SR-04	Provenance	Protects	T1048	Exfiltration Over Alternative Protocol
PUR-IP-E5	Information Protection	Technique Scores	T1048	Exfiltration Over Alternative Protocol
DEF-AIR-E5	Automated Investigation and Response	Technique Scores	T1048	Exfiltration Over Alternative Protocol
DO365-ATH-E5	Advanced Threat Hunting	Technique Scores	T1048	Exfiltration Over Alternative Protocol

ATT&CK Subtechniques

Technique ID	Technique Name	Number of Mappings
T1048.001	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	12
T1048.002	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	23
T1048.003	Exfiltration Over Unencrypted Non-C2 Protocol	23