T1041 Exfiltration Over C2 Channel
Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.
Quién la usa · con noticias en Jábega
Reglas Sigma para cazarla
- Equation Group C2 Communicationhightest · firewall
- OpenCanary - TFTP Requesthightest · opencanary
- Shai-Hulud NPM Package Malicious Exfiltration via Curlhighexperimental · linux
- Network Communication Initiated To Portmap.IO Domainmediumtest · windows
Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.