THREATNOIR
Subscribe
MITRE ATT&CK · T1048

Exfiltration Over Alternative Protocol

MITRE · cited in 9 of our lessons

Explanation

What attackers do. Attackers send stolen data out using a different protocol from their main command and control channel, such as FTP, SMB, DNS or a custom encrypted protocol, to avoid controls focused on web traffic. This serves the Exfiltration tactic.

How to defend. Block outbound protocols the business does not need and force traffic through monitored egress points. Use internal DNS resolvers only and inspect DNS for tunnelling. Apply data loss prevention and network monitoring to detect unusual volumes or destinations.

Signs to look for. Look for outbound FTP, SMB or other uncommon protocols to the internet, unusually long or numerous DNS queries, and large transfers from hosts that rarely send data. A common gap is permissive egress rules on servers.

Open the technique on MITRE ATT&CK
The official text
Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Adversaries may also opt to encrypt and/or obfuscate these alternate channels. Exfiltration Over Alternative Protocol can be done using various common operating system utilities such as Net/SMB or FTP. On macOS and Linux `curl` may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.