MirrorFaceG1054 ↗
Has used Secure File Transfer Protocol (SFTP) for file exfiltration.1
tfMITRE ATT&CK sub-technique
Exfiltration Over Asymmetric Encrypted Non-C2 Protocol T1048.002
sub-technique of T1048 Exfiltration Over Alternative Protocol
- Tactic
- Exfiltration
- Platforms
- ESXi, Linux, macOS, Windows
- Version
- 1.2
- Created
- 15 March 2020
- Last modified
- 12 May 2026
- Contributor
- William Cain
Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
4
Threat groups70th pct
Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.3
Tools & malware57th pct
Tools & malware57th percentile · 57% of ATT&CK techniques have this many tools implementing them or fewer.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Exfiltration Over Asymmetric Encrypted Non-C2 Protocol MITRE reference T1048.002
70th pctamong all ATT&CK techniques for number of groups
4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Storm-1811G1046 ↗
Has exfiltrated captured user credentials via Secure Copy Protocol (SCP).1
CURIUMG1012 ↗
Has used SMTPS to exfiltrate collected data from victims.1
APT28G0007 ↗
Has exfiltrated archives of collected data previously staged on a target's OWA server via HTTPS.1
All 4 groups for this technique
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
SolarWinds CompromiseC0024 ↗
During the SolarWinds Compromise, APT29 exfiltrated collected data over a simple HTTPS request to a password-protected archive staged on a victim's OWA servers.1
All 1 campaigns for this technique
3 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
BRUSHFIRES9011 ↗
Has the ability to exfiltrate data on-demand through executing commands obtained via monitoring for specially crafted packets and sending output back in an embedded SSL response.1
RcloneS1040 ↗
Can exfiltrate data over SFTP or HTTPS via WebDAV.1
IcedIDS0483 ↗
Has exfiltrated collected data via HTTPS.1
All 3 software entries for this technique
Offense vs defense T1048.002
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Exfiltration Over Asymmetric Encrypted Non-C2 Protocol detection strategy DET0512
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
4 platforms
AN1413 · Windows
Detects non-browser processes that establish encrypted outbound connections (e.g., TLS/SSL) to unfamiliar or atypical destinations for the host/user, following a data staging or compression event.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| File AccessDC0055 | WinEventLog:Security | EventCode=4663, 4670, 4656 |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
| Network Traffic ContentDC0085 | NSM:Flow | ssl.log - Certificate Analysis |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Correlates file access, encryption, and network transmission within a timeframe (e.g., 5 minutes). |
| CertificateIssuerDenylist | Blocks or flags untrusted certificate authorities in SSL/TLS handshakes. |
| BinaryAllowlist | Whitelist for known-good applications allowed to use encrypted outbound traffic. |
AN1414 · Linux
Detects staged file access (e.g., archive or obfuscation), followed by an encrypted outbound connection (TLS/HTTPS) from unusual processes such as curl/wget, Python scripts, or custom binaries.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve |
| File AccessDC0055 | auditd:SYSCALL | open, read |
| Network Connection CreationDC0082 | auditd:SYSCALL | connect |
| Network Traffic ContentDC0085 | NSM:Flow | ssl.log, conn.log |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ConnectionDestinationScope | Restrict outbound connections to non-corporate domains or IPs. |
| FileAccessExtensionList | List of extensions considered sensitive or exfil-worthy (e.g., .zip, .db, .xlsx). |
| SSLClientProcessBaseline | Define normal encrypted-traffic-capable binaries. |
AN1415 · macOS
Detects abnormal encrypted network connections (via TLS/HTTPS) initiated by non-browser binaries, particularly after sensitive file access or compression events.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:osquery | process_events |
| File AccessDC0055 | macos:unifiedlog | log stream - file provider subsystem |
| Network Traffic FlowDC0078 | macos:osquery | socket_events |
| Network Traffic ContentDC0085 | NSM:Flow | ssl.log, x509.log |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| OutboundTrafficVolumeThreshold | Trigger detection for large amounts of outbound encrypted data. |
| FileSensitivityContext | Tagging and prioritizing high-value directories/files in detection logic. |
AN1416 · ESXi
Detects unexpected encrypted outbound connections from management components or guest VMs using TLS, particularly after data volume spikes or script-based orchestration from within guest environments.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Command ExecutionDC0064 | esxi:hostd | event stream |
| Network Traffic FlowDC0078 | esxi:vmkernel | egress logs |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| VMToEgressPathWatchlist | Expected traffic routes for monitored VMs. |
| TLSClientAppIdentifier | Applications allowed to initiate TLS sessions from hypervisor level. |
Data Loss PreventionM1057
Data loss prevention can detect and block sensitive data being uploaded via web browsers.
Enforce proxies and use dedicated servers for services such as DNS and only allow those systems to communicate over respective ports/protocols, instead of all systems within a network.
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary command and control infrastructure and malware can be used to mitigate activity at the network level.
Network SegmentationM1030
Follow best practices for network firewall configurations to allow only necessary ports and traffic to enter and exit the network.
Tests4Executorssh 2 · cmd 1 · bash 1Need elevation0 of 4Have prerequisites1Have cleanup0Platformswindows, macos, linux
Tests from Atomic Red Team (MIT licence) · technique definition