tfMITRE ATT&CK sub-technique

Exfiltration Over Symmetric Encrypted Non-C2 Protocol T1048.001

sub-technique of T1048 Exfiltration Over Alternative Protocol

Tactic: Exfiltration
Platforms: Linux, macOS, Windows, ESXi
Version: 1.1
Created: 15 March 2020
Last modified: 24 October 2025

Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rules42nd pct

Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.

Offense vs defense T1048.001

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 0

first rule: 2019 Q4

Exfiltration Over Symmetric Encrypted Non-C2 Protocol detection strategy DET0503

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavioral Detection Strategy for Exfiltration Over Symmetric Encrypted Non-C2 Protocol

Enterprise

4 platforms

AN1389 · Windows

Detects the execution of non-browser processes establishing outbound encrypted network connections using uncommon symmetric encryption protocols (e.g., AES via PowerShell or custom scripts) to alternate external destinations.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
PayloadEntropyThreshold	Flag high-entropy payloads sent over unexpected protocols.
TimeWindow	Define allowable transfer window (e.g., abnormal traffic outside business hours).
ExecutableAllowlist	List of known-good binaries for encrypted traffic (e.g., Chrome, Outlook).

AN1390 · Linux

Detects command-line utilities or scripts using encryption libraries or symmetric algorithms (e.g., OpenSSL AES, GPG, Python + PyCrypto) in conjunction with outbound file transfers or traffic to external destinations.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
Network Traffic FlowDC0078	NSM:Flow	conn.log or flow data
Network Connection CreationDC0082	auditd:SYSCALL	connect
Network Traffic ContentDC0085	NSM:Flow	ssl.log (for TLS handshake analysis), dns.log (tunneling indicators)

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
FileTransferIndicator	Threshold for transferred data size or extension type.
LibraryCallTracking	Hooks into use of encryption libraries like `libcrypto.so`, `pycrypto`, `gpg`.

AN1391 · macOS

Detects symmetric key-based encryption operations (e.g., AES via Python, AppleScript, or OpenSSL) followed by unusual outbound connections from non-browser applications or scripted tools.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	log stream process subsystem
Network Traffic FlowDC0078	macos:osquery	socket_events
Network Connection CreationDC0082	macos:unifiedlog	log stream network activity

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ApplicationProfileBaseline	Expected outbound connection profiles per app.
EncryptionRoutinePattern	Indicators of manual encryption operations (e.g., script strings invoking AES).

AN1392 · ESXi

Detects unexpected encrypted egress traffic from management services (e.g., hostd) or guest VMs utilizing symmetric encryption without traditional protocols (e.g., FTP with embedded AES ciphertext).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	esxi:hostd	execution + payload hints
Network Traffic FlowDC0078	esxi:vmkernel	egress log analysis
Network Traffic ContentDC0085	NSM:Flow	host switch egress data

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
GuestVMExfilWatchlist	VMs with data sensitivity labels or outside normal behavior.
ServiceEgressProfile	Expected egress destinations and volume for core services.

Exfiltration Over Symmetric Encrypted Non-C2 Protocol detections T1048.001

1 rule is mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

42nd pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs