Exfiltration Over C2 Channel
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
T1041's defining act is data leaving over a channel that is already open; pushing bytes through an established socket generates no new Sysmon EventID 3, so the technique's own signature is unobservable in any log source this brief offers, and MITRE's analytic (a byte-volume anomaly plus file-access-then-egress ordering) cannot be expressed in Sigma at all. The only observable near this technique is the moment a channel is established by a script host or transfer utility — a precursor shared identically with T1071 (C2) and T1105 (tool transfer), with no field on the event that distinguishes which of the three is happening. […]
What the technique is
Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN0988
Identifies suspicious outbound traffic volume mismatches from processes that typically do not generate network activity, particularly over C2 protocols like HTTPS, DNS, or custom TCP/UDP ports, following file or data access.
- AN0989
Monitors for processes reading sensitive files then immediately initiating unusual outbound connections or bulk transfer sessions over persistent sockets, particularly with encrypted or binary payloads.
- AN0990
Detects unauthorized applications or scripts accessing sensitive data followed by establishing encrypted outbound communication to rare external destinations or with abnormal byte ratios.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.