THREATNOIR
Subscribe
MITRE ATT&CK · T1041

Exfiltration Over C2 Channel

MITRE · cited in 11 of our lessons

Explanation

What attackers do. Attackers send stolen data out through the same command and control channel they already use to control compromised systems, so no new connection is needed. This serves the Exfiltration tactic.

How to defend. Limit and monitor outbound traffic, send it through proxies and apply data loss prevention where practical. Detecting and cutting the command and control channel early prevents this as well. Set baselines for normal outbound data volumes per host.

Signs to look for. Look for hosts sending much more data out than they receive, beacon traffic that suddenly grows, and large uploads to rare destinations. A common gap is watching only for exfiltration to well-known file sharing sites while ignoring volume changes on existing channels.

Open the technique on MITRE ATT&CK
The official text
Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.