T1041 Exfiltration Over C2 Channel
Adversaries may steal data by exfiltrating it over an existing command and control channel. MITRE ATT&CK
1 program on CmdID 2 Sigma rules T1041 on attack.mitre.org
Programs for it
Sigma rules tagged with it
highShai-Hulud NPM Package Malicious Exfiltration via CurlSwachchhanda Shrawan Poudel (Nextron Systems) · Linux