T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.

Asymmetric encryption algorithms are those that use different keys on each end of the channel. Also known as public-key cryptography, this requires pairs of cryptographic keys that can encrypt/decrypt data from the corresponding key. Each end of the communication channels requires a private key (only in the procession of that entity) and the public key of the other entity. The public keys of each entity are exchanged before encrypted communications begin.

Network protocols that use asymmetric encryption (such as HTTPS/TLS/SSL) often utilize symmetric encryption once keys are exchanged. Adversaries may opt to use these encrypted mechanisms that are baked into a protocol.

View in MITRE ATT&CK®

CRI Profile Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
DE.AE-02.01 Event analysis and detection Mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
Comments
This diagnostic statement provides for implementation of methods to block similar future attacks via security tools such as antivirus and IDS/IPS to provide protection against threats and exploitation attempts.
References
    PR.IR-03.01 Alternative resilience mechanisms Mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
    Comments
    This diagnostic statement protects against Exfiltration Over Asymmetric Encrypted Non-C2 Protocol through the use of failsafes, backup facilities, disaster recovery, and resilience strategies including resumption of critical services.
    References
      DE.CM-01.03 Unauthorized network connections and data transfers Mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
      Comments
      This diagnostic statement provides protection from Exfiltration Over Asymmetric Encrypted Non-C2 Protocol by using tools to detect and block the use of unauthorized devices and connections to prevent abuse by adversaries.
      References
        PR.DS-01.02 Data loss prevention Mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
        Comments
        The use of data loss prevention controls may mitigate the techniques related to data leakage and loss from local systems, automated exfiltration, and exfiltration over non-approved services.
        References
          PR.IR-01.01 Network segmentation Mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
          Comments
          This diagnostic statement is for the implementation of network segmentation which helps prevent access to critical systems and sensitive information. Network firewall configurations that allow only necessary ports and traffic can mitigate exfiltration of data over alternate protocols.
          References
            PR.IR-04.01 Utilization monitoring Mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
            Comments
            This diagnostic statement describes how the organization establishes and manages baseline measures of network activity. Supported by network monitoring tools and other controls to detect events and identify incidents. Mitigating mechanisms may include: Data Loss Prevention (DLP); Filtering Network Traffic; Limit Network Traffic; Network Intrusion Prevention Systems (NIPS); and Network Segmentation for these type of network-based techniques.
            References
              PR.IR-04.01 Utilization monitoring Mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
              Comments
              This diagnostic statement describes how the organization establishes and manages baseline measures of network activity. Supported by network monitoring tools and other controls to detect events and identify incidents. Mitigating mechanisms may include: Data Loss Prevention (DLP); Filtering Network Traffic; Limit Network Traffic; Network Intrusion Prevention Systems (NIPS); and Network Segmentation for these type of network-based techniques.
              References
                PR.IR-01.02 Network device configurations Mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
                Comments
                This diagnostic statement provides protection through secure network device configurations (e.g., firewall rules, ports, protocols) aligned to security baselines. Using network appliances to block or filter network traffic that is not necessary within the environment can mitigate adversary use of alternate protocols to exfiltrate data.
                References
                  PR.IR-01.03 Network communications integrity and availability Mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
                  Comments
                  This diagnostic statement protects against Exfiltration Over Asymmetric Encrypted Non-C2 Protocol through the use of secure network configurations, architecture, implementations of zero trust architecture, and segmentation.
                  References
                    PR.IR-01.04 Wireless network protection Mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
                    Comments
                    This diagnostic statement provides protections for wireless networks. Implementation of wireless network management measures such as network segmentation and access controls reduces the attack surface, restricts movement by adversaries, and protects data from compromise.
                    References
                      PR.PS-01.08 End-user device protection Mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
                      Comments
                      This diagnostic statement protects against Exfiltration Over Asymmetric Encrypted Non-C2 Protocol through the use of limiting access to resources to only authorized devices, management of personal computing devices, network intrusion prevention, and the use of antimalware.
                      References

                        NIST 800-53 Mappings

                        Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                        CA-07 Continuous Monitoring mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
                        CM-06 Configuration Settings mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
                        AC-23 Data Mining Protection mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
                        CA-03 Information Exchange mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
                        SA-09 External System Services mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
                        SC-31 Covert Channel Analysis mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
                        SR-04 Provenance mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
                        SC-28 Protection of Information at Rest mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
                        SC-46 Cross Domain Policy Enforcement mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
                        SI-10 Information Input Validation mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
                        SI-15 Information Output Filtering mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
                        SI-03 Malicious Code Protection mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
                        AC-16 Security and Privacy Attributes mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
                        AC-20 Use of External Systems mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
                        CM-02 Baseline Configuration mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
                        SA-08 Security and Privacy Engineering Principles mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
                        CM-07 Least Functionality mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
                        SI-04 System Monitoring mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
                        AC-02 Account Management mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
                        AC-03 Access Enforcement mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
                        AC-04 Information Flow Enforcement mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
                        AC-06 Least Privilege mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
                        SC-07 Boundary Protection mitigates T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

                        VERIS Mappings

                        Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                        attribute.confidentiality.data_disclosure None related-to T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

                        Azure Mappings

                        Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                        azure_firewall Azure Firewall technique_scores T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
                        Comments
                        This control's threat intelligence-based filtering feature can be enabled to alert and deny traffic from/to known malicious IP addresses and domains. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed. Because this protection is limited to known malicious IP addresses and domains and does not provide protection from such attacks from unknown domains and IP addresses, this is scored as partial coverage resulting in an overall Partial score.
                        References
                        azure_network_security_groups Azure Network Security Groups technique_scores T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
                        Comments
                        This control can reduce the protocols available for data exfiltration. Temporal immediate, coverage substantial.
                        References
                        azure_network_watcher_traffic_analytics Azure Network Watcher: Traffic Analytics technique_scores T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
                        Comments
                        This control can identify anomalous traffic with respect specific ports (though it can't identify presence or lack of encryption).
                        References

                        AWS Mappings

                        Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                        amazon_virtual_private_cloud Amazon Virtual Private Cloud technique_scores T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
                        Comments
                        VPC security groups and network access control lists (NACLs) can limit access to the minimum required ports and therefore protect against adversaries attempting to exfiltrate data using a different protocol than that of the existing command and control channel. In environments where unrestricted Internet access is required, security groups and NACLs can still be used to block known malicious endpoints. Because in such environments the protection is limited to known malicious IP addresses and domains and does not provide protection from such attacks from unknown domains and IP addresses, this is scored as partial coverage resulting in an overall Partial score.
                        References
                          aws_iot_device_defender AWS IoT Device Defender technique_scores T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
                          Comments
                          The following AWS IoT Device Defender device-side detection metrics can detect indicators that an adversary may be exfiltrating collected data from compromised AWS IoT devices over a given channel to/from those devices: "Destination IPs" ("aws:destination-ip-addresses") outside of expected IP address ranges may suggest that a device is communicating with unexpected parties. "Bytes in" ("aws:all-bytes-in"), "Bytes out" ("aws:all-bytes-out"), "Packets in" ("aws:all-packets-in"), and "Packets out" ("aws:all-packets-out") values outside of expected norms may indicate that the device is sending and/or receiving non-standard traffic, which may include exfiltration of stolen data. "Listening TCP ports" ("aws:listening-tcp-ports"), "Listening TCP port count" ("aws:num-listening-tcp-ports"), "Established TCP connections count" ("aws:num-established-tcp-connections"), "Listening UDP ports" ("aws:listening-udp-ports"), and "Listening UDP port count" ("aws:num-listening-udp-ports") values outside of expected norms may indicate that devices are communicating via unexpected ports/protocols, which may include exfiltration of data over those ports/protocols. Coverage factor is partial, since these metrics are limited to exfiltration from IoT devices, resulting in an overall score of Partial.
                          References
                            aws_network_firewall AWS Network Firewall technique_scores T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
                            Comments
                            AWS Network Firewall has the ability to pass, drop, or alert on traffic based on the network protocol as well as perform deep packet inspection on the payload. This functionality can be used to block adversaries from accessing resources from which to exfiltrate data as well as prevent resources from communicating with known-bad IP addresses and domains that might be used to receive exfiltrated data. This mapping is given a score of Partial because the known-bad IP addresses and domains would need to be known in advance and AWS Network Firewall wouldn't have deep packet inspection visibility into encrypted non-C2 protocols.
                            References