CmdID / Techniques / T1048

T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol

Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. MITRE ATT&CK

3 programs on CmdID 3 Sigma rules T1048.003 on attack.mitre.org

Part of

MITRE ATT&CK

T1048Exfiltration Over Alternative Protocol

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

cmd.exeUpload pythonits Sigma rules rundll32.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first

highSuspicious WebDav Client Execution Via Rundll32.EXENasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems) · Windows

mediumPython WebServer Execution - LinuxMohamed LAKRI · Linux

mediumWebDav Client Execution Via Rundll32.EXERoberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) · Windows