[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1048":3},{"item":4,"lessons":18,"controls":56,"related":84},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1048","T1048","Exfiltration Over Alternative Protocol",9,"MITRE","**What attackers do.** Attackers send stolen data out using a different protocol from their main command and control channel, such as FTP, SMB, DNS or a custom encrypted protocol, to avoid controls focused on web traffic. This serves the Exfiltration tactic.\n\n**How to defend.** Block outbound protocols the business does not need and force traffic through monitored egress points. Use internal DNS resolvers only and inspect DNS for tunnelling. Apply data loss prevention and network monitoring to detect unusual volumes or destinations.\n\n**Signs to look for.** Look for outbound FTP, SMB or other uncommon protocols to the internet, unusually long or numerous DNS queries, and large transfers from hosts that rarely send data. A common gap is permissive egress rules on servers.","Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.  \n\nAlternate protocols include FTP, SMTP, HTTP\u002FS, DNS, SMB, or any other network protocol not being used as the main command and control channel. Adversaries may also opt to encrypt and\u002For obfuscate these alternate channels. \n\nExfiltration Over Alternative Protocol can be done using various common operating system utilities such as Net\u002FSMB or FTP. On macOS and Linux `curl` may be used to invoke protocols such as HTTP\u002FS or FTP\u002FS to exfiltrate data from a system.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1048\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52],{"slug":21,"title":22,"published_at":23},"iranian-hackers-abuse-dns-and-cloud-apis-to-hide-c2-traffic","Iranian Hackers Abuse DNS and Cloud APIs to Hide C2 Traffic","2026-08-17T20:21:38.331+00:00",{"slug":25,"title":26,"published_at":27},"ai-models-exploit-jfrog-zero-days-breaching-hugging-face-systems","AI Models Exploit JFrog Zero-Days, Breaching Hugging Face Systems","2026-07-29T10:22:05.577+00:00",{"slug":29,"title":30,"published_at":31},"ai-models-exploit-artifactory-zero-days-to-escape-isolated-environment","AI Models Exploit Artifactory Zero-Days to Escape Isolated Environment","2026-07-28T22:21:06.867+00:00",{"slug":33,"title":34,"published_at":35},"ai-models-escape-sandbox-state-hackers-exploit-zimbra-zero-day","AI Models Escape Sandbox, State Hackers Exploit Zimbra Zero-Day","2026-07-25T12:20:22.01+00:00",{"slug":37,"title":38,"published_at":39},"russian-hackers-exploit-zimbra-zero-click-xss-to-steal-email-mfa-tokens","Russian Hackers Exploit Zimbra Zero-Click XSS to Steal Email & MFA Tokens","2026-07-23T18:20:44.189+00:00",{"slug":41,"title":42,"published_at":43},"hollowgraph-malware-abuses-microsoft-graph-api-for-covert-c2-via-calendar-events","HollowGraph Malware Abuses Microsoft Graph API for Covert C2 via Calendar Events","2026-07-20T18:20:26.927+00:00",{"slug":45,"title":46,"published_at":47},"hollowgraph-malware-abuses-microsoft-365-calendars-for-covert-c2-and-data-exfiltration","HollowGraph Malware Abuses Microsoft 365 Calendars for Covert C2 and Data Exfiltration","2026-07-20T17:20:26.13+00:00",{"slug":49,"title":50,"published_at":51},"okobots-seedhunter-module-hijacks-ledger-and-trezor-apps-to-steal-crypto-seed-phrases","OkoBot's SeedHunter Module Hijacks Ledger and Trezor Apps to Steal Crypto Seed Phrases","2026-07-15T18:20:55.57+00:00",{"slug":53,"title":54,"published_at":55},"helix-group-exploits-vishing-and-mfa-abuse-to-steal-sharepoint-data","Helix Group Exploits Vishing and MFA Abuse to Steal SharePoint Data","2026-07-09T18:20:54.638+00:00",[57,62,67,71,76,80],{"slug":58,"name":59,"problem":60,"stories":61},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",5,{"slug":63,"name":64,"problem":65,"stories":66},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",3,{"slug":68,"name":69,"problem":70,"stories":66},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":72,"name":73,"problem":74,"stories":75},"patch-management","Automated patch management","Known holes get closed in days, not months.",2,{"slug":77,"name":78,"problem":79,"stories":75},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":81,"name":82,"problem":83,"stories":75},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[85,91,97,102,106,111,115,119],{"family":86,"item":87,"code":88,"title":89,"together":90},"cis","13","Control 13","Network Monitoring and Defense",7,{"family":92,"item":93,"code":94,"title":95,"together":96},"gdpr","32","Article 32","Security of processing",6,{"family":98,"item":99,"code":100,"title":101,"together":61},"nist-800-53","si-4","SI-4","System Monitoring",{"family":98,"item":103,"code":104,"title":105,"together":61},"sc-7","SC-7","Boundary Protection",{"family":98,"item":107,"code":108,"title":109,"together":110},"ac-17","AC-17","Remote Access",4,{"family":86,"item":112,"code":113,"title":114,"together":110},"7","Control 7","Continuous Vulnerability Management",{"family":86,"item":116,"code":117,"title":118,"together":110},"6","Control 6","Access Control Management",{"family":120,"item":121,"code":122,"title":122,"together":110},"itil","overview","ITIL"]