Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Asymmetric encryption algorithms are those that use different keys on each end of the channel. Also known as public-key cryptography, this requires pairs of cryptographic keys that can encrypt/decrypt data from the corresponding key. Each end of the communication channels requires a private key (only in the procession of that entity) and the public key of the other entity. The public keys of each entity are exchanged before encrypted communications begin.
Network protocols that use asymmetric encryption (such as HTTPS/TLS/SSL) often utilize symmetric encryption once keys are exchanged. Adversaries may opt to use these encrypted mechanisms that are baked into a protocol.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| AC-3 | Access Enforcement | Protects | T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | |
| AC-4 | Information Flow Enforcement | Protects | T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | |
| CA-7 | Continuous Monitoring | Protects | T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | |
| CM-2 | Baseline Configuration | Protects | T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | |
| CM-6 | Configuration Settings | Protects | T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | |
| CM-7 | Least Functionality | Protects | T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | |
| SC-46 | Cross Domain Policy Enforcement | Protects | T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | |
| SC-7 | Boundary Protection | Protects | T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | |
| SI-10 | Information Input Validation | Protects | T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | |
| SI-15 | Information Output Filtering | Protects | T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | |
| SI-3 | Malicious Code Protection | Protects | T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | |
| SI-4 | System Monitoring | Protects | T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | |
| action.malware.variety.Export data | Export data to another site or system | related-to | T1048.002 | Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | |
| aws_iot_device_defender | AWS IoT Device Defender | technique_scores | T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol |
Comments
The following AWS IoT Device Defender device-side detection metrics can detect indicators that an adversary may be exfiltrating collected data from compromised AWS IoT devices over a given channel to/from those devices: "Destination IPs" ("aws:destination-ip-addresses") outside of expected IP address ranges may suggest that a device is communicating with unexpected parties. "Bytes in" ("aws:all-bytes-in"), "Bytes out" ("aws:all-bytes-out"), "Packets in" ("aws:all-packets-in"), and "Packets out" ("aws:all-packets-out") values outside of expected norms may indicate that the device is sending and/or receiving non-standard traffic, which may include exfiltration of stolen data. "Listening TCP ports" ("aws:listening-tcp-ports"), "Listening TCP port count" ("aws:num-listening-tcp-ports"), "Established TCP connections count" ("aws:num-established-tcp-connections"), "Listening UDP ports" ("aws:listening-udp-ports"), and "Listening UDP port count" ("aws:num-listening-udp-ports") values outside of expected norms may indicate that devices are communicating via unexpected ports/protocols, which may include exfiltration of data over those ports/protocols.
Coverage factor is partial, since these metrics are limited to exfiltration from IoT devices, resulting in an overall score of Partial.
References
|
| amazon_virtual_private_cloud | Amazon Virtual Private Cloud | technique_scores | T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol |
Comments
VPC security groups and network access control lists (NACLs) can limit access to the minimum required ports and therefore protect against adversaries attempting to exfiltrate data using a different protocol than that of the existing command and control channel. In environments where unrestricted Internet access is required, security groups and NACLs can still be used to block known malicious endpoints. Because in such environments the protection is limited to known malicious IP addresses and domains and does not provide protection from such attacks from unknown domains and IP addresses, this is scored as partial coverage resulting in an overall Partial score.
References
|
| aws_network_firewall | AWS Network Firewall | technique_scores | T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol |
Comments
AWS Network Firewall has the ability to pass, drop, or alert on traffic based on the network protocol as well as perform deep packet inspection on the payload. This functionality can be used to block adversaries from accessing resources from which to exfiltrate data as well as prevent resources from communicating with known-bad IP addresses and domains that might be used to receive exfiltrated data. This mapping is given a score of Partial because the known-bad IP addresses and domains would need to be known in advance and AWS Network Firewall wouldn't have deep packet inspection visibility into encrypted non-C2 protocols.
References
|