Techniques › T1048 › T1048.003

T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

exfiltration — ESXi, Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON

KEV CVEs mapped to this technique · CTID Mappings Explorer

Detection strategy · ATT&CK Enterprise v19.2

• DET0149 Detection of Exfiltration Over Unencrypted Non-C2 Protocol v1.0
  AN0423 Windows

  Detects data access or staging events followed by outbound data flows using unencrypted protocols (e.g., FTP, HTTP) initiated by unexpected processes or to rare destinations.

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Security EventCode=4663, 4670, 4656 → DC0055 File Access

  NSM:Flow http.log, ftp.log → DC0085 Network Traffic Content

  Tunable: UnencryptedProtocolList DataTransferSizeThreshold ParentProcessDenylist
  AN0424 Linux

  Detects file access or compression utilities followed by outbound connections using curl, wget, ftp, or custom binaries communicating over unencrypted protocols.

  auditd:SYSCALL execve → DC0032 Process Creation

  auditd:SYSCALL connect → DC0082 Network Connection Creation

  NSM:Flow http.log, ftp.log → DC0085 Network Traffic Content

  NSM:Flow flow records → DC0078 Network Traffic Flow

  Tunable: SensitiveDirectoryWatchlist ProcessBaseline TimeWindow
  AN0425 macOS

  Detects abnormal outbound HTTP/FTP connections by local scripts or binaries outside of standard browser activity, following access to local documents or user data.

  macos:osquery socket_events → DC0078 Network Traffic Flow

  macos:osquery process_events → DC0032 Process Creation

  macos:unifiedlog log stream - file subsystem → DC0055 File Access

  NSM:Flow http.log, ftp.log → DC0085 Network Traffic Content

  Tunable: ScriptedClientAllowlist PayloadInspectionKeywordList
  AN0426 ESXi

  Detects shell-based scripts accessing configuration files or snapshots and transmitting them over unencrypted protocols such as FTP or HTTP to non-management IPs.

  esxi:hostd event stream → DC0064 Command Execution

  NSM:Flow flow records → DC0078 Network Traffic Flow

  NSM:Flow http.log → DC0085 Network Traffic Content

  Tunable: VMConfigAccessPathWatchlist OutboundProtocolProfile
  AN0427 Network Devices

  Detects use of unencrypted protocols (e.g., TFTP, FTP, HTTP) to transfer configuration files, routing tables, or logs to untrusted IP addresses, especially using administrative commands like copy run ftp:.

  networkdevice:cli CLI command logs → DC0064 Command Execution

  networkdevice:syslog flow records → DC0078 Network Traffic Flow

  NSM:Flow PCAP inspection → DC0085 Network Traffic Content

  Tunable: ProtocolCommandWatchlist DestinationIPBlocklist

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1048.003

Rules tagged at the parent level (attack.t1048) 12

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.