Quick links
Press Enter to search, Esc to close
Attack technique
Exfiltration over a C2 channel is when an attacker sends stolen data out through the same channel they already use to control the infected system.
In short
Exfiltration over a C2 channel is when an attacker sends stolen data out through the same channel they already use to control the infected system. The data is hidden inside what looks like normal control traffic, so no second route out of the network is needed. MITRE ATT&CK tracks it as T1041 under Exfiltration.
Exfiltration · Step 14 Of 15 In The Attack Chain
An attacker who controls a system usually keeps a command and control channel open, called C2 for short. Through it they send instructions to the system and receive replies.
With this technique, the stolen data travels back over that same channel. MITRE says the data is encoded into the normal communications channel and uses the same protocol as the C2 traffic.
This is simple for the attacker because no second route out of the network is needed. It also means the stolen data can blend in with traffic that is already there.
MITRE ATT&CK lists these procedure examples:
Look for processes that rarely use the network but suddenly send a lot of data out, over HTTPS, DNS or custom ports, after reading files or data.
Look for a process that reads sensitive files and then quickly opens an unusual outbound connection or a bulk transfer, especially with encrypted content.
Look for unauthorized applications or scripts sending encrypted traffic to rare external destinations, and for virtual machines sending traffic to unknown places.
DET0348, Detection Strategy for Exfiltration Over C2 Channel.
Data loss prevention can detect and block sensitive data that is sent over unencrypted protocols.
Signature-based network tools can flag traffic from known malware. Attackers are likely to change their C2 traffic over time, so signatures need regular updates and will not catch everything.
It is when an attacker sends stolen data back through the same command and control channel they use to control the infected system. MITRE says the data is encoded into that channel and uses the same protocol as the C2 traffic. It is tracked as T1041.
It is simple, because no second route out of the network is needed. The stolen data can also blend in with traffic that is already there.
Look for processes that rarely use the network but suddenly send a lot of data out over HTTPS, DNS or custom ports after reading files. Also link sensitive file reads to new outbound connections or bulk transfers.
Data loss prevention can detect and block sensitive data sent over unencrypted protocols. Signature-based network intrusion detection can flag known malware traffic, but attackers change their C2 traffic over time, so signatures need regular updates.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.
