T1041 · Exfiltration Over C2 Channel

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1041 · Exfiltration Over C2 Channel · Sunturai

attack-patternenterprise-attackT1041

Exfiltration Over C2 Channel

attack-pattern--92d7da27-2d91-488e-a00c-059dc162766d

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.

Created: May 31, 2017, 9:30 PM UTC
Modified: May 12, 2026, 3:12 PM UTC

104 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Cisco Secure Firewall - Intrusion Events by Threat Activity	Informational	Splunk security content	Oct 6, 2026	Apache License 2.0
Unusual Windows Network Activity	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Spike in Network Traffic To a Country	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Network Traffic to Rare Destination Country	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unusual Network Destination Domain Name	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unusual Linux Network Port Activity	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unusual Linux Network Activity	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Spike in Network Traffic	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Spike in Firewall Denies	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Spike in host-based traffic	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
DNS Tunneling	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Network Activity Detected via Kworker	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unusual GCP Event for a User	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Data Exfiltration Activity to an Unusual Region	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Data Exfiltration Activity to an Unusual Destination Port	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Data Exfiltration Activity to an Unusual IP Address	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Data Exfiltration Activity to an Unusual ISO Code	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unusual Azure Activity Logs Event for a User	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unusual AWS Command for a User	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Cisco ASA - Possible Data Exfiltration Detection	Medium	Microsoft Sentinel analytics	Sep 17, 2026	MIT License
FortiNDR Cloud - Security Event Detected	High	Microsoft Sentinel analytics	Sep 15, 2026	MIT License
Cisco Cloud Security - Request Allowed to harmful/malicious URI category	Medium	—	Sep 4, 2026	MIT License
Cisco Cloud Security - Rare User Agent Detected	Medium	—	Sep 4, 2026	MIT License
Cisco Cloud Security - Crypto Miner User-Agent Detected	Medium	—	Sep 4, 2026	MIT License
Cisco Cloud Security - Connection to Unpopular Website Detected	Medium	—	Sep 4, 2026	MIT License

Showing 25 of 104

Filter in the catalogue

External references

mitre-attackT1041Open reference

University of Birmingham C2Open reference

Platforms

ESXiLinuxmacOSWindows

Kill chain phases

exfiltration

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object