Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| AC-4 | Information Flow Enforcement | Protects | T1041 | Exfiltration Over C2 Channel | |
| CA-7 | Continuous Monitoring | Protects | T1041 | Exfiltration Over C2 Channel | |
| SC-7 | Boundary Protection | Protects | T1041 | Exfiltration Over C2 Channel | |
| SI-3 | Malicious Code Protection | Protects | T1041 | Exfiltration Over C2 Channel | |
| SI-4 | System Monitoring | Protects | T1041 | Exfiltration Over C2 Channel | |
| action.malware.variety.Export data | Export data to another site or system | related-to | T1041 | Exfiltration Over C2 Channels | |
| amazon_guardduty | Amazon GuardDuty | technique_scores | T1041 | Exfiltration Over C2 Channel |
Comments
The following GuardDuty finding type flags events that may indicate adversaries attempting to exfiltrate data, such as sensitive documents.
Behavior:EC2/TrafficVolumeUnusual
Accuracy and Coverage is unknown, as this finding flags traffic volume that differs from a baseline.
References
|
| aws_iot_device_defender | AWS IoT Device Defender | technique_scores | T1041 | Exfiltration Over C2 Channel |
Comments
The following AWS IoT Device Defender device-side detection metrics can detect indicators that an adversary may be exfiltrating collected data from compromised AWS IoT devices using an established command and control channel to/from those devices: "Destination IPs" ("aws:destination-ip-addresses") outside of expected IP address ranges may suggest that a device is communicating with unexpected parties. "Bytes in" ("aws:all-bytes-in"), "Bytes out" ("aws:all-bytes-out"), "Packets in" ("aws:all-packets-in"), and "Packets out" ("aws:all-packets-out") values outside of expected norms may indicate that the device is sending and/or receiving non-standard traffic, which may include exfiltration of stolen data. "Listening TCP ports" ("aws:listening-tcp-ports"), "Listening TCP port count" ("aws:num-listening-tcp-ports"), "Established TCP connections count" ("aws:num-established-tcp-connections"), "Listening UDP ports" ("aws:listening-udp-ports"), and "Listening UDP port count" ("aws:num-listening-udp-ports") values outside of expected norms may indicate that devices are communicating via unexpected ports/protocols, which may include exfiltration of data over command and control channels.
Coverage factor is partial, since these metrics are limited to exfiltration from IoT devices, resulting in an overall score of Partial.
References
|
| aws_network_firewall | AWS Network Firewall | technique_scores | T1041 | Exfiltration Over C2 Channel |
Comments
AWS Network Firewall has the ability to pass, drop, or alert on traffic based on the network protocol as well as perform deep packet inspection on the payload. This functionality can be used to block adversaries from accessing resources from which to exfiltrate data as well as prevent resources from communicating with known-bad IP addresses and domains that might be used to receive exfiltrated data. This mapping is given a score of Partial because the known-bad IP addresses and domains would need to be known in advance.
References
|