CmdID

CmdID / Techniques / T1048

T1048.001 Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol

Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel. MITRE ATT&CK

1 Sigma rule T1048.001 on attack.mitre.org

Part of

MITRE ATT&CK
T1048Exfiltration Over Alternative Protocol

Sigma rules tagged with it

process creation, the highest levels first
highDNS Exfiltration and Tunneling Tools ExecutionDaniil Yugoslavskiy, oscd.community · Windows