T1048 Exfiltration Over Alternative Protocol

Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. MITRE ATT&CK

2 programs on CmdID 7 Sigma rules T1048 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK

T1048.001Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol

T1048.003Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

bcp.exeits Sigma rules testwindowremoteagent.exeUpload

Sigma rules tagged with it

process creation, the highest levels first

highPUA - Restic Backup Tool ExecutionNounou Mbeiri, Swachchhanda Shrawan Poudel (Nextron Systems) · Windows

highSuspicious Redirection to Local Admin ShareFlorian Roth (Nextron Systems) · Windows

mediumCopy From Or To Admin Share Or Sysvol FolderFlorian Roth (Nextron Systems), oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Nasreddine Bencherchali · Windows

mediumData Export From MSSQL Table Via BCP.EXEOmar Khaled (@beacon_exe), MahirAli Khan (in/mahiralikhan), Nasreddine Bencherchali (Nextron Systems) · Windows

mediumFTP Connection Open Attempt Via Winscp CLIfrack113 · Windows

mediumTap Installer ExecutionDaniil Yugoslavskiy, Ian Davis, oscd.community · Windows

mediumWinscp Execution From Non Standard Folderfrack113 · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Copy a mandatory snippet from a folder to a destination folder on the page for New-IseSnippet

$path = "$HOME\Documents\WindowsPowerShell\Snippets\Mandatory.Snippets.ps1xml"
$destination = "\\Server\Share"
Copy-Item -Path $path -Destination $destination

Identify

An example is here when CmdID’s reading of it names T1048: a Sigma rule it trips is tagged with it, or its abuse is documented as it.