T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
Sub-technique of T1048 Exfiltration Over Alternative Protocol
Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.(Citation: copy_cmd_cisco) Adversaries may opt to obfuscate this data, without the use of encryption, within network protocols that are natively…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Suspicious WebDav Client Execution Via Rundll32.EXEhightest · windows
- Data Exfiltration with Wgetmediumtest · linux
- PowerShell ICMP Exfiltrationmediumtest · windows
- Suspicious DNS Query with B64 Encoded Stringmediumtest · dns
- Suspicious Outbound SMTP Connectionsmediumtest · windows
- WebDav Client Execution Via Rundll32.EXEmediumtest · windows
- Python WebServer Execution - Linuxmediumexperimental · linux
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.