Techniques › T1048
T1048 Exfiltration Over Alternative Protocol
exfiltration — ESXi, IaaS, Linux, macOS, Network Devices, Office Suite, SaaS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
12
Sigma rules tagged attack.t1048
4
KEV CVEs mapped here
<p>Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.</p><p>Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Adversaries may also opt to encrypt and/or obfuscate these alternate channels.</p><p>Exfiltration Over Alternative Protocol can be done using various common operating system utilities such as Net/SMB or FTP. On macOS and Linux <code>curl</code> may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system.</p><p>Many IaaS and SaaS platforms (such as Microsoft Exchange, Microsoft SharePoint, GitHub, and AWS S3) support the direct download of files, emails, source code, and other sensitive information via the web console or Cloud API.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2017-6742 | Cisco IOS and IOS XE Software | secondary impact | Mapped | 2023-04-19 |
| CVE-2022-26500 | Veeam Backup & Replication | secondary impact | Mapped | 2022-12-13 |
| CVE-2022-26501 | Veeam Backup & Replication | secondary impact | Mapped | 2022-12-13 |
| CVE-2013-0641 | Adobe Reader | secondary impact | Mapped | 2022-03-03 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0131 Behavioral Detection Strategy for Exfiltration Over Alternative Protocol v1.0
AN0367 WindowsDetects unusual outbound file transfer behavior using protocols like FTP, SMB, SMTP, or DNS, involving non-standard processes, off-hour activity, or uncommonly high volume.Tunable:
DataVolumeThresholdMBProtocolAllowListTimeWindowParentProcessAnomalyAN0368 LinuxDetects file exfiltration using tools like curl, scp, or custom binaries over protocols such as FTP, HTTP/S, or DNS tunneling, especially outside baseline user behavior.Tunable:ProtocolTypeUserContextFileExtensionSensitivityAN0369 macOSDetects non-native file transfer via curl, Python scripts, or AppleScript using uncommon protocols like FTP, SMTP, or DNS exfiltration through mDNSResponder abuse.macos:unifiedloglog stream (subsystem: com.apple.system.networking)→ DC0085 Network Traffic ContentTunable:ProtocolUnusualnessScoreExecutableBaseliningAN0370 IaaSDetects access to cloud APIs or CLI tools to move or sync files from sensitive buckets to external endpoints using protocols like HTTPS or S3 APIs.Tunable:IAMRoleContextGeoDestinationThresholdAN0371 ESXiDetects outbound traffic from hostd/vpxa or guest VM interfaces using unauthorized protocols such as FTP, HTTP POST bursts, or long-lived DNS tunnels.Tunable:GuestTrafficBaselineServiceAccountProfile
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1048
Author: Nounou Mbeiri, Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-10-17 · logsource: product=windows category=process_creation · 6ddff2e8-ea1a-45d0-8938-93dfc1d67ae7
Detects the execution of the Restic backup tool, which can be used for data exfiltration.
Threat actors may leverage Restic to back up and exfiltrate sensitive data to remote storage locations, including cloud services.
If not legitimately used in the enterprise environment, its presence may indicate malicious activity.
Author: frack113
· 2025-10-12 · logsource: product=windows category=process_creation · 7674f8ef-7141-4cf0-a311-ee359264c64c
Detects the execution of Winscp from an a non standard folder. This could indicate the execution of Winscp portable.
Author: Florian Roth (Nextron Systems), oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Nasreddine Bencherchali
· 2019-12-30 (modified 2025-10-22) · logsource: product=windows category=process_creation · 855bc8b5-2ae8-402e-a9ed-b889e6df1900
Detects a copy command or a copy utility execution to or from an Admin share or remote
Author: Daniil Yugoslavskiy, Ian Davis, oscd.community
· 2019-10-24 (modified 2022-12-25) · logsource: product=windows service=system · 8e4cf0e5-aa5d-4dc3-beff-dc26917744a9
Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques
Author: Daniil Yugoslavskiy, Ian Davis, oscd.community
· 2019-10-24 (modified 2023-12-11) · logsource: product=windows category=process_creation · 99793437-3e16-439b-be0f-078782cf953d
Well-known TAP software installation. Possible preparation for data exfiltration using tunneling techniques
Author: Daniil Yugoslavskiy, Ian Davis, oscd.community
· 2019-10-24 (modified 2022-11-29) · logsource: product=windows service=security · 9c8afa4d-0022-48f0-9456-3712466f9701
Detects the installation of a well-known TAP driver service. This could be a sign of potential preparation for data exfiltration using tunnelling techniques.
Author: Saw Winn Naung , Azure-Sentinel
· 2021-08-15 (modified 2025-09-12) · logsource: product=zeek service=dns · a8322756-015c-42e7-afb1-436e85ed3ff5
Identifies IPs performing DNS lookups associated with common Tor proxies.
Author: Florian Roth (Nextron Systems)
· 2022-01-16 (modified 2023-12-28) · logsource: product=windows category=process_creation · ab9e3b40-0c85-4ba1-aede-455d226fd124
Detects a suspicious output redirection to the local admins share, this technique is often found in malicious scripts or hacktool stagers
Author: Leonardo Gasparini
· 2026-05-12 · logsource: product=windows category=dns_query · ac5a4e3f-7f9d-6abc-d8ea-3b4c5f6a7b8c
Detects DNS queries to attacker-controlled infrastructure used by the Mini Shai-Hulud campaign targeting TanStack npm packages along with other packages such as mistralai, uipath and so on.
The domain git-tanstack.com (registered May 9, 2026) hosted secondary payloads including transformers.pyz.
The filev2.getsession.org endpoint was used for credential exfiltration via the Session protocol.
Author: frack113
· 2025-10-12 · logsource: product=windows category=process_creation · c1477deb-37cf-4439-9ffb-44499acb89d0
Detects the execution of Winscp with the "-command" and the "open" flags in order to open an FTP connection. Akira ransomware was seen using this technique in order to exfiltrate data.
Author: Omar Khaled (@beacon_exe), MahirAli Khan (in/mahiralikhan), Nasreddine Bencherchali (Nextron Systems)
· 2024-08-20 · logsource: product=windows category=process_creation · c615d676-f655-46b9-b913-78729021e5d7
Detects the execution of the BCP utility in order to export data from the database.
Attackers were seen saving their malware to a database column or table and then later extracting it via "bcp.exe" into a file.
Author: frack113
· 2022-01-07 · logsource: product=windows category=ps_script · d59d7842-9a21-4bc6-ba98-64bfe0091355
DNSExfiltrator allows for transferring (exfiltrate) a file over a DNS request covert channel