PlayG1040 ↗
Has used WinSCP to exfiltrate data to actor-controlled accounts.12
tfMITRE ATT&CK technique
Exfiltration Over Alternative Protocol T1048
- Tactic
- Exfiltration
- Platforms
- ESXi, IaaS, Linux, macOS, Network Devices, Office Suite, SaaS, Windows
- Version
- 1.6
- Created
- 31 May 2017
- Last modified
- 24 October 2025
- Contributors
- William Cain; Alfredo Abarca
Sub-techniques 347 rules across the family · 20 mapped directly to T1048 · 2 of 3 carry rules
Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
2
Threat groups56th pct
Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.7
Tools & malware71st pct
Tools & malware71st percentile · 71% of ATT&CK techniques have this many tools implementing them or fewer.20
Detection rulesTop 14%
Detection rules86th percentile · 86% of ATT&CK techniques have this many detection rules written or fewer.Exfiltration Over Alternative Protocol MITRE reference T1048
56th pctamong all ATT&CK techniques for number of groups
2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 2 groups for this technique
7 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
AADInternalsS0677 ↗
Can directly download cloud user data such as OneDrive files.1
KobalosS0641 ↗
Can exfiltrate credentials over the network via UDP.1
ChaesS0631 ↗
Has exfiltrated its collected data from the infected machine to the C2, sometimes using the MIME protocol.1
FrameworkPOSS0503 ↗
Can use DNS tunneling for exfiltration of credit card data.1
BundloreS0482 ↗
Uses the curl -s -L -o command to exfiltrate archived data to a URL.1
PoetRATS0428 ↗
Has used a .NET tool named dog.exe to exiltrate information over an e-mail account.1
All 7 software entries for this technique · 6 newest in this preview
Offense vs defense T1048
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 15Splunk ESCU (cumulative) · 5
first rule: 2019 Q4Exfiltration Over Alternative Protocol detection strategy DET0131
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavioral Detection Strategy for Exfiltration Over Alternative Protocol
5 platforms
AN0367 · Windows
Detects unusual outbound file transfer behavior using protocols like FTP, SMB, SMTP, or DNS, involving non-standard processes, off-hour activity, or uncommonly high volume.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| DataVolumeThresholdMB | Set threshold for outbound volume (e.g., >50MB in a single connection). |
| ProtocolAllowList | Allow-listed protocols in use for specific machines or users (e.g., FTP allowed for backups). |
| TimeWindow | Define allowed time-of-day windows (e.g., flag after-hours file transfer). |
| ParentProcessAnomaly | Identify anomalous parent-child process relationships (e.g., winword.exe spawning ftp.exe). |
AN0368 · Linux
Detects file exfiltration using tools like curl, scp, or custom binaries over protocols such as FTP, HTTP/S, or DNS tunneling, especially outside baseline user behavior.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve |
| File AccessDC0055 | auditd:SYSCALL | open |
| File ModificationDC0061 | auditd:SYSCALL | write |
| Network Traffic FlowDC0078 | NSM:Flow | NetFlow/Zeek conn.log |
| Network Connection CreationDC0082 | auditd:SYSCALL | connect |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ProtocolType | Flag unexpected protocols (e.g., HTTP on port 53 or FTP traffic from non-standard tools). |
| UserContext | Scope for privilege escalation or service account behavior. |
| FileExtensionSensitivity | Track movement of file types of interest (e.g., .csv, .sql, .key). |
AN0369 · macOS
Detects non-native file transfer via curl, Python scripts, or AppleScript using uncommon protocols like FTP, SMTP, or DNS exfiltration through mDNSResponder abuse.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:osquery | process_events |
| File CreationDC0039 | macos:osquery | file_events |
| Network Traffic ContentDC0085 | macos:unifiedlog | log stream (subsystem: com.apple.system.networking) |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ProtocolUnusualnessScore | Weight rarely-used protocols in user space. |
| ExecutableBaselining | Track which binaries usually call curl/nc and alert on deviation. |
AN0370 · IaaS
Detects access to cloud APIs or CLI tools to move or sync files from sensitive buckets to external endpoints using protocols like HTTPS or S3 APIs.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Cloud Storage AccessDC0025 | AWS:CloudTrail | GetObject, CopyObject |
| Network Traffic FlowDC0078 | AWS:VPCFlowLogs | Outbound data flows |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| IAMRoleContext | Detect unauthorized use of roles for cloud storage manipulation. |
| GeoDestinationThreshold | Alert on outbound flows to geo-locations not seen in training baseline. |
AN0371 · ESXi
Detects outbound traffic from hostd/vpxa or guest VM interfaces using unauthorized protocols such as FTP, HTTP POST bursts, or long-lived DNS tunnels.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Command ExecutionDC0064 | esxi:hostd | logline inspection |
| Network Connection CreationDC0082 | esxi:vmkernel | protocol egress |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| GuestTrafficBaseline | Expected protocols used by VMs attached to host interfaces. |
| ServiceAccountProfile | Unexpected network activity from hypervisor processes or monitoring agents. |
Data Loss PreventionM1057
Data loss prevention can detect and block sensitive data being uploaded via web browsers.
Enforce proxies and use dedicated servers for services such as DNS and only allow those systems to communicate over respective ports/protocols, instead of all systems within a network. Cloud service providers support IP-based restrictions when accessing cloud resources. Consider using IP allowlisting along with user account management to ensure that data access is restricted not only to valid users but only from expected IP ranges to mitigate the use of stolen credentials to access data.
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary command and control infrastructure and malware can be used to mitigate activity at the network level.
Network SegmentationM1030
Follow best practices for network firewall configurations to allow only necessary ports and traffic to enter and exit the network.
Use access control lists on cloud storage systems and objects.
Configure user permissions groups and roles for access to cloud storage. Implement strict Identity and Access Management (IAM) controls to prevent access to storage solutions except for the applications, users, and services that require access. Ensure that temporary access tokens are issued rather than permanent credentials, especially when access is being granted to entities outside of the internal security boundary.
Tests4Executorssh 2 · PowerShell 1 · bash 1Need elevation0 of 4Have prerequisites2Have cleanup0Platformsmacos, linux, windows
Tests from Atomic Red Team (MIT licence) · technique definition