{"id":"T1048.003","name":"Exfiltration Over Unencrypted Non-C2 Protocol","url":"https://attack.mitre.org/techniques/T1048/003","tactics":["exfiltration"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0149","stix_id":"x-mitre-detection-strategy--a772e6e0-017e-4ceb-b125-4620ac85a5bd","name":"Detection of Exfiltration Over Unencrypted Non-C2 Protocol","url":"https://attack.mitre.org/detectionstrategies/DET0149","analytics":[{"id":"AN0423","stix_id":"x-mitre-analytic--d265376d-3cdc-4e95-a8ea-4c4278860218","name":"Analytic 0423","description":"Detects data access or staging events followed by outbound data flows using unencrypted protocols (e.g., FTP, HTTP) initiated by unexpected processes or to rare destinations.","url":"https://attack.mitre.org/detectionstrategies/DET0149#AN0423","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"wineventlog-security"},{"name":"NSM:Flow","channel":"http.log, ftp.log","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"UnencryptedProtocolList","description":"Set of protocols considered suspicious for outbound data exfiltration (e.g., FTP, HTTP)."},{"field":"DataTransferSizeThreshold","description":"Defines what amount of outbound data is considered abnormal for a host/user."},{"field":"ParentProcessDenylist","description":"Processes that should not launch FTP/HTTP clients (e.g., winword.exe launching ftp.exe)."}],"live":true,"detection_strategies":["DET0149"],"techniques":["T1048.003"]},{"id":"AN0424","stix_id":"x-mitre-analytic--ad5fb8d4-7f1c-4442-a4e5-96592364c4cc","name":"Analytic 0424","description":"Detects file access or compression utilities followed by outbound connections using curl, wget, ftp, or custom binaries communicating over unencrypted protocols.","url":"https://attack.mitre.org/detectionstrategies/DET0149#AN0424","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"connect","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"auditd-syscall"},{"name":"NSM:Flow","channel":"http.log, ftp.log","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"},{"name":"NSM:Flow","channel":"flow records","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"SensitiveDirectoryWatchlist","description":"Flag access to paths known to store sensitive or regulated data."},{"field":"ProcessBaseline","description":"Define which binaries are allowed to communicate externally using HTTP/FTP."},{"field":"TimeWindow","description":"Correlates process/file/network within a defined time window."}],"live":true,"detection_strategies":["DET0149"],"techniques":["T1048.003"]},{"id":"AN0425","stix_id":"x-mitre-analytic--b608c89f-ce2c-4993-8522-7b2731851606","name":"Analytic 0425","description":"Detects abnormal outbound HTTP/FTP connections by local scripts or binaries outside of standard browser activity, following access to local documents or user data.","url":"https://attack.mitre.org/detectionstrategies/DET0149#AN0425","platforms":["macOS"],"log_source_references":[{"name":"macos:osquery","channel":"socket_events","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"macos-osquery"},{"name":"macos:osquery","channel":"process_events","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-osquery"},{"name":"macos:unifiedlog","channel":"log stream - file subsystem","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"macos-unifiedlog"},{"name":"NSM:Flow","channel":"http.log, ftp.log","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"ScriptedClientAllowlist","description":"Defines allowed automated agents that may transmit HTTP or FTP data (e.g., backup tools)."},{"field":"PayloadInspectionKeywordList","description":"Terms or patterns indicating structured or sensitive data leaving via HTTP/FTP."}],"live":true,"detection_strategies":["DET0149"],"techniques":["T1048.003"]},{"id":"AN0426","stix_id":"x-mitre-analytic--82f3feb5-f17e-4c1c-b67d-c8331d220905","name":"Analytic 0426","description":"Detects shell-based scripts accessing configuration files or snapshots and transmitting them over unencrypted protocols such as FTP or HTTP to non-management IPs.","url":"https://attack.mitre.org/detectionstrategies/DET0149#AN0426","platforms":["ESXi"],"log_source_references":[{"name":"esxi:hostd","channel":"event stream","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"esxi-hostd"},{"name":"NSM:Flow","channel":"flow records","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"nsm-flow"},{"name":"NSM:Flow","channel":"http.log","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"VMConfigAccessPathWatchlist","description":"Locations of VMX/CFG/SNAPSHOT files that should not be accessed by non-admin shells."},{"field":"OutboundProtocolProfile","description":"Expected network protocols for guest and host interfaces."}],"live":true,"detection_strategies":["DET0149"],"techniques":["T1048.003"]},{"id":"AN0427","stix_id":"x-mitre-analytic--611778c2-9de4-4066-b7d1-78752891c32e","name":"Analytic 0427","description":"Detects use of unencrypted protocols (e.g., TFTP, FTP, HTTP) to transfer configuration files, routing tables, or logs to untrusted IP addresses, especially using administrative commands like `copy run ftp:`.","url":"https://attack.mitre.org/detectionstrategies/DET0149#AN0427","platforms":["Network Devices"],"log_source_references":[{"name":"networkdevice:cli","channel":"CLI command logs","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"networkdevice-cli"},{"name":"networkdevice:syslog","channel":"flow records","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"networkdevice-syslog"},{"name":"NSM:Flow","channel":"PCAP inspection","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"ProtocolCommandWatchlist","description":"Flag commands like `copy`, `archive tar`, or `upload` directed at external hosts."},{"field":"DestinationIPBlocklist","description":"Define external IP ranges unauthorized to receive router/switch configs."}],"live":true,"detection_strategies":["DET0149"],"techniques":["T1048.003"]}],"live":true,"version":"1.0","techniques":["T1048.003"]}],"sigma_rules":[{"id":"2dbd9d3d-9e27-42a8-b8df-f13825c6c3d5","title":"WebDav Client Execution Via Rundll32.EXE","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"medium","date":"2020-05-02","modified":"2023-09-18","description":"Detects \"svchost.exe\" spawning \"rundll32.exe\" with command arguments like \"C:\\windows\\system32\\davclnt.dll,DavSetCookie\".\nThis could be an indicator of exfiltration or use of WebDav to launch code (hosted on a WebDav server).\n","references":["https://github.com/OTRF/detection-hackathon-apt29/issues/17","https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/7.B.4_C10730EA-6345-4934-AA0F-B0EFCA0C4BA6.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.exfiltration","attack.t1048.003"],"path":"rules/windows/process_creation/proc_creation_win_rundll32_webdav_client_execution.yml","techniques":["T1048.003"],"cves":[]},{"id":"3f0f5957-04f8-4792-ad89-192b0303bde6","title":"Python WebServer Execution - Linux","author":"Mohamed LAKRI","status":"experimental","level":"medium","date":"2025-10-17","modified":null,"description":"Detects the execution of Python web servers via command line interface (CLI).\nAfter gaining access to target systems, adversaries may use Python's built-in HTTP server modules to quickly establish a web server without requiring additional software.\nThis technique is commonly used in post-exploitation scenarios as it provides a simple method for transferring files between the compromised host and attacker-controlled systems.\n","references":["https://www.atomicredteam.io/atomic-red-team/atomics/T1048.003#atomic-test-8---python3-httpserver","https://docs.python.org/3/library/http.server.html","https://docs.python.org/2/library/simplehttpserver.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.exfiltration","attack.t1048.003"],"path":"rules/linux/process_creation/proc_creation_lnx_python_http_server_execution.yml","techniques":["T1048.003"],"cves":[]},{"id":"4153a907-2451-4e4f-a578-c52bb6881432","title":"Suspicious DNS Query with B64 Encoded String","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2018-05-10","modified":"2022-10-09","description":"Detects suspicious DNS queries using base64 encoding","references":["https://github.com/krmaxwell/dns-exfiltration"],"logsource":{"category":"dns"},"tags":["attack.exfiltration","attack.t1048.003","attack.command-and-control","attack.t1071.004"],"path":"rules/network/dns/net_dns_susp_b64_queries.yml","techniques":["T1048.003","T1071.004"],"cves":[]},{"id":"4c4af3cd-2115-479c-8193-6b8bfce9001c","title":"PowerShell ICMP Exfiltration","author":"Bartlomiej Czyz @bczyz1, oscd.community","status":"test","level":"medium","date":"2020-10-10","modified":"2022-12-25","description":"Detects Exfiltration Over Alternative Protocol - ICMP. Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1048.003/T1048.003.md#atomic-test-2---exfiltration-over-alternative-protocol---icmp"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.exfiltration","attack.t1048.003"],"path":"rules/windows/powershell/powershell_script/posh_ps_icmp_exfiltration.yml","techniques":["T1048.003"],"cves":[]},{"id":"705072a5-bb6f-4ced-95b6-ecfa6602090b","title":"WebDav Put Request","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"low","date":"2020-05-02","modified":"2024-03-13","description":"A General detection for WebDav user-agent being used to PUT files on a WebDav network share. This could be an indicator of exfiltration.","references":["https://github.com/OTRF/detection-hackathon-apt29/issues/17"],"logsource":{"product":"zeek","service":"http"},"tags":["attack.exfiltration","attack.t1048.003"],"path":"rules/network/zeek/zeek_http_webdav_put_request.yml","techniques":["T1048.003"],"cves":[]},{"id":"982e9f2d-1a85-4d5b-aea4-31f5e97c6555","title":"Suspicious WebDav Client Execution Via Rundll32.EXE","author":"Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2023-03-16","modified":"2023-09-18","description":"Detects \"svchost.exe\" spawning \"rundll32.exe\" with command arguments like C:\\windows\\system32\\davclnt.dll,DavSetCookie. This could be an indicator of exfiltration or use of WebDav to launch code (hosted on WebDav Server) or potentially a sign of exploitation of CVE-2023-23397\n","references":["https://twitter.com/aceresponder/status/1636116096506818562","https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/","https://www.pwndefend.com/2023/03/15/the-long-game-persistent-hash-theft/","https://www.microsoft.com/en-us/security/blog/wp-content/uploads/2023/03/Figure-7-sample-webdav-process-create-event.png","https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.exfiltration","attack.t1048.003","cve.2023-23397"],"path":"rules/windows/process_creation/proc_creation_win_rundll32_webdav_client_susp_execution.yml","techniques":["T1048.003"],"cves":["CVE-2023-23397"]},{"id":"9976fa64-2804-423c-8a5b-646ade840773","title":"Suspicious Outbound SMTP Connections","author":"frack113","status":"test","level":"medium","date":"2022-01-07","modified":"2022-09-21","description":"Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.\nThe data may also be sent to an alternate network location from the main command and control server.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1048.003/T1048.003.md#atomic-test-5---exfiltration-over-alternative-protocol---smtp","https://www.ietf.org/rfc/rfc2821.txt"],"logsource":{"product":"windows","category":"network_connection"},"tags":["attack.exfiltration","attack.t1048.003"],"path":"rules/windows/network_connection/net_connection_win_susp_outbound_smtp_connections.yml","techniques":["T1048.003"],"cves":[]},{"id":"9a7afa56-4762-43eb-807d-c3dc9ffe211b","title":"Potential Data Exfiltration Over SMTP Via Send-MailMessage Cmdlet","author":"frack113","status":"test","level":"medium","date":"2022-09-26","modified":"2024-11-01","description":"Detects the execution of a PowerShell script with a call to the \"Send-MailMessage\" cmdlet along with the \"-Attachments\" flag. This could be a potential sign of data exfiltration via Email.\nAdversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1048.003/T1048.003.md#atomic-test-5---exfiltration-over-alternative-protocol---smtp","https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/send-mailmessage?view=powershell-7.4","https://www.ietf.org/rfc/rfc2821.txt"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.exfiltration","attack.t1048.003","detection.threat-hunting"],"path":"rules-threat-hunting/windows/powershell/powershell_script/posh_ps_send_mailmessage.yml","techniques":["T1048.003"],"cves":[]},{"id":"cb39d16b-b3b6-4a7a-8222-1cf24b686ffc","title":"Data Exfiltration with Wget","author":"Pawel Mazur","status":"test","level":"medium","date":"2021-11-18","modified":"2022-12-25","description":"Detects attempts to post the file with the usage of wget utility.\nThe adversary can bypass the permission restriction with the misconfigured sudo permission for wget utility which could allow them to read files like /etc/shadow.\n","references":["https://linux.die.net/man/1/wget","https://gtfobins.github.io/gtfobins/wget/"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.exfiltration","attack.t1048.003"],"path":"rules/linux/auditd/execve/lnx_auditd_data_exfil_wget.yml","techniques":["T1048.003"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2021-34473","state":"mapped","mapping_types":["secondary_impact"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}