Description
Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Adversaries may also opt to encrypt and/or obfuscate these alternate channels.
Exfiltration Over Alternative Protocol can be done using various common operating system utilities such as Net/SMB or FTP.(Citation: Palo Alto OilRig Oct 2016) On macOS and Linux curl may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system.(Citation: 20 macOS Common Tools and Techniques)
Many IaaS and SaaS platforms (such as Microsoft Exchange, Microsoft SharePoint, GitHub, and AWS S3) support the direct download of files, emails, source code, and other sensitive information via the web console or Cloud API.
Platforms
Sub-Techniques (3)
Exfiltration Over Symmetric Encrypted Non-C2 Protocol
T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
T1048.003Exfiltration Over Unencrypted Non-C2 Protocol
Mitigations (6)
Network SegmentationM1030
Follow best practices for network firewall configurations to allow only necessary ports and traffic to enter and exit the network.(Citation: TechNet Firewall Design)
Data Loss PreventionM1057
Data loss prevention can detect and block sensitive data being uploaded via web browsers.
Filter Network TrafficM1037
Enforce proxies and use dedicated servers for services such as DNS and only allow those systems to communicate over respective ports/protocols, instead of all systems within a network. Cloud service providers support IP-based restrictions when accessing cloud resources. Consider using IP allowlisting along with user account management to ensure that data access is restricted not only to valid user
Network Intrusion PreventionM1031
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary command and control infrastructure and malware can be used to mitigate activity at the network level.
Restrict File and Directory PermissionsM1022
Use access control lists on cloud storage systems and objects.
User Account ManagementM1018
Configure user permissions groups and roles for access to cloud storage.(Citation: Microsoft Azure Storage Security, 2019) Implement strict Identity and Access Management (IAM) controls to prevent access to storage solutions except for the applications, users, and services that require access.(Citation: Amazon S3 Security, 2019) Ensure that temporary access tokens are issued rather than permanent
Threat Groups (2)
| ID | Group | Context |
|---|---|---|
| G1040 | Play | [Play](https://attack.mitre.org/groups/G1040) has used WinSCP to exfiltrate data to actor-controlled accounts.(Citation: CISA Play Ransomware Advisory... |
| G0139 | TeamTNT | [TeamTNT](https://attack.mitre.org/groups/G0139) has sent locally staged files with collected credentials to C2 servers using cURL.(Citation: Cisco Ta... |
Associated Software (7)
| ID | Name | Type | Context |
|---|---|---|---|
| S0482 | Bundlore | Malware | [Bundlore](https://attack.mitre.org/software/S0482) uses the <code>curl -s -L -o</code> command to exfiltrate archived data to a URL.(Citation: 20 mac... |
| S0428 | PoetRAT | Malware | [PoetRAT](https://attack.mitre.org/software/S0428) has used a .NET tool named dog.exe to exiltrate information over an e-mail account.(Citation: Talos... |
| S0631 | Chaes | Malware | [Chaes](https://attack.mitre.org/software/S0631) has exfiltrated its collected data from the infected machine to the C2, sometimes using the MIME prot... |
| S0503 | FrameworkPOS | Malware | [FrameworkPOS](https://attack.mitre.org/software/S0503) can use DNS tunneling for exfiltration of credit card data.(Citation: SentinelOne FrameworkPOS... |
| S0641 | Kobalos | Malware | [Kobalos](https://attack.mitre.org/software/S0641) can exfiltrate credentials over the network via UDP.(Citation: ESET Kobalos Jan 2021) |
| S0203 | Hydraq | Malware | [Hydraq](https://attack.mitre.org/software/S0203) connects to a predefined domain on port 443 to exfil gathered information.(Citation: Symantec Hydraq... |
| S0677 | AADInternals | Tool | [AADInternals](https://attack.mitre.org/software/S0677) can directly download cloud user data such as OneDrive files.(Citation: AADInternals Documenta... |
References
- Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
- Grunzweig, J. and Falcone, R.. (2016, October 4). OilRig Malware Campaign Updates Toolset and Expands Targets. Retrieved May 3, 2017.
- Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.
Frequently Asked Questions
What is T1048 (Exfiltration Over Alternative Protocol)?
T1048 is a MITRE ATT&CK technique named 'Exfiltration Over Alternative Protocol'. It belongs to the Exfiltration tactic(s). Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main...
How can T1048 be detected?
Detection of T1048 (Exfiltration Over Alternative Protocol) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1048?
There are 6 documented mitigations for T1048. Key mitigations include: Network Segmentation, Data Loss Prevention, Filter Network Traffic, Network Intrusion Prevention, Restrict File and Directory Permissions.
Which threat groups use T1048?
Known threat groups using T1048 include: Play, TeamTNT.