T1048 · Exfiltration Over Alternative Protocol

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1048 · Exfiltration Over Alternative Protocol · Sunturai

attack-patternenterprise-attackT1048

Exfiltration Over Alternative Protocol

attack-pattern--a19e86f8-1c0a-4fea-8407-23b73d615776

Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Adversaries may also opt to encrypt and/or obfuscate these alternate channels. Exfiltration Over Alternative Protocol can be done using various common operating system utilities such as Net/SMB or FTP.(Citation: Palo Alto OilRig Oct 2016) On macOS and Linux curl may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system.(Citation: 20 macOS Common Tools and Techniques) Many IaaS and SaaS platforms (such as Microsoft Exchange, Microsoft SharePoint, GitHub, and AWS S3) support the direct download of files, emails, source code, and other sensitive information via the web console or Cloud API.

Created: May 31, 2017, 9:30 PM UTC
Modified: Oct 24, 2025, 5:49 PM UTC

3 sub-techniques under this technique

Each is its own technique in the catalogue, with its own detections.

120 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Ollama Possible Model Exfiltration Data Leakage	Informational	Splunk security content	Oct 14, 2026	Apache License 2.0
Potential Data Exfiltration Through Curl	Medium	Elastic detection rules	Oct 7, 2026	Elastic License 2.0
Prohibited Network Traffic Allowed	Informational	Splunk security content	Oct 6, 2026	Apache License 2.0
LLM-Based Wget Activity Triage	Medium	Elastic detection rules	Oct 2, 2026	Elastic License 2.0
LLM-Based Wget Activity Triage via Auditd	Medium	Elastic detection rules	Oct 2, 2026	Elastic License 2.0
LLM-Based Curl Activity Triage	Medium	Elastic detection rules	Oct 2, 2026	Elastic License 2.0
LLM-Based Curl Activity Triage via Auditd	Medium	Elastic detection rules	Oct 2, 2026	Elastic License 2.0
Potential DNS Tunneling via NULL or Long DNS Queries	Medium	Elastic detection rules	Sep 29, 2026	Elastic License 2.0
SMB (Windows File Sharing) Activity to the Internet	Medium	Elastic detection rules	Sep 22, 2026	Elastic License 2.0
Rare SMB Connection to the Internet	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Data Exfiltration via Rclone	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential DNS Exfiltration via Excessive Chunked Queries	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Windows Registry File Creation in SMB Share	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
SMTP to the Internet on Port 26/TCP	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unusual Windows Network Activity	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Spike in Network Traffic To a Country	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Network Traffic to Rare Destination Country	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Spike in host-based traffic	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unusual DNS Activity	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
File Transfer Utility Launched from Unusual Parent	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Data Exfiltration Through Wget	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Database Dumping Activity	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
File Transfer or Listener Established via Netcat	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Network Activity Detected via cat	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Netcat File Transfer or Listener Detected via Defend for Containers	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0

Showing 25 of 120

Filter in the catalogue

External references

mitre-attackT1048Open reference

University of Birmingham C2Open reference

Palo Alto OilRig Oct 2016

20 macOS Common Tools and TechniquesOpen reference

Platforms

ESXiIaaSLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows

Kill chain phases

exfiltration

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object