Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.
Threat groups94th percentile · 93% of ATT&CK techniques have fewer threat groups attributed.
10
CampaignsTop 3%
Campaigns97th percentile · 96% of ATT&CK techniques have fewer campaigns recorded.
166
Tools & malwareTop 2%
Tools & malware98th percentile · 98% of ATT&CK techniques have fewer tools implementing them.
16
Detection rulesTop 16%
Detection rules84th percentile · 83% of ATT&CK techniques have fewer detection rules written.
Exfiltration Over C2 Channel MITRE reference T1041
Top 6%of all ATT&CK techniques for number of groups
27 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP.1
During HomeLand Justice, threat actors used HTTP to transfer data from compromised Exchange servers.1
2021–2022
All 10 campaigns for this technique · 6 newest in this preview
166 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Has uploaded files to the C2 server. Additionally, MuddyViper has the ability to upload the specified file in chunks with sleep time between each chunk.1
Exfiltration Over C2 Channel detection strategy DET0348
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Exfiltration Over C2 Channel
Enterprise
4 platforms
AN0988 · Windows
Identifies suspicious outbound traffic volume mismatches from processes that typically do not generate network activity, particularly over C2 protocols like HTTPS, DNS, or custom TCP/UDP ports, following file or data access.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
DataVolumeThreshold
Set threshold for outbound transfer size exceeding typical C2 traffic (e.g., >1MB in <5min).
KnownBenignProcesses
List of approved processes that may exhibit high outbound traffic (e.g., updates).
AN0989 · Linux
Monitors for processes reading sensitive files then immediately initiating unusual outbound connections or bulk transfer sessions over persistent sockets, particularly with encrypted or binary payloads.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
OutboundEntropyScore
Threshold for high-entropy payloads indicative of encoded or encrypted exfil data.
ConnectionDuration
Defines length of time over which transfer size must be aggregated to trigger detection.
AN0990 · macOS
Detects unauthorized applications or scripts accessing sensitive data followed by establishing encrypted outbound communication to rare external destinations or with abnormal byte ratios.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
ParentProcessAncestry
Enables defenders to tune legitimate vs. suspicious lineage (e.g., launchd → curl is uncommon).
ProtocolList
Focus detection on unusual protocols (e.g., IRC, FTP, DNS over HTTPS).
AN0991 · ESXi
Detects VMs sending outbound traffic through non-standard services or to unknown destinations. Exfiltration over reverse shells tunneled via VMkernel or custom payloads routed via hostd/vpxa.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool command and control signatures over time or construct protocols in such a way to avoid detection by common defensive tools.
Tests2Executorspowershell 2Need elevation0 of 2Have prerequisites0Have cleanup0Platformswindows
#
Test
Platform
Executor
Elevation
Prereqs
Cleanup
Ref
01
C2 Data Exfiltration
windows
powershell
—
—
—
Exfiltrates a file present on the victim machine to the C2 server.
Inputs
Name
Description
Type
Default Value
filepath
The file which is being exfiltrated to the C2 Server.
The following analytic detects connections with a high Encrypted Visibility Engine (EVE) threat confidence score, indicating potentially malicious behavior within encrypted traffic. (...)
The following analytic detects potentially suspicious large volumes of data sent by the connection initiator on flows from internal to external networks. (...)