Exfiltration Over C2 Channel is ATT&CK T1041. It belongs to the Exfiltration tactic and applies to ESXi, Linux, macOS and Windows.
How attackers use it
MITRE keeps the definition short. Adversaries may steal data by exfiltrating it over an existing command and control channel. The stolen data is encoded into the normal communications channel, using the same protocol as the command and control traffic.
That has a defensive consequence. There is no new connection to spot, no new protocol and no new destination. The data rides inside traffic that already exists. The procedure examples on the page are consistently plain: malware sending files or host details to its own command server, and tools such as Putty and WinSCP used by one group to talk to its servers.
How to detect it
The MITRE analytics concentrate on the outbound side and on what happened just before:
- Outbound traffic volume that does not fit a process that does not usually generate network traffic, especially over protocols such as HTTPS, DNS or custom TCP and UDP ports, following file or data access.
- A process that reads sensitive files and then immediately opens an unusual outbound connection or starts a bulk transfer over a persistent socket.
- Unauthorized applications or scripts reading data and then building an encrypted connection to a rare external destination or with an abnormal ratio of bytes sent to bytes received.
- On ESXi, virtual machines sending outbound traffic through non-standard services or to unknown destinations.
So collect network flow or proxy logs with bytes in each direction, and endpoint network connection logs that name the process. On Windows, Sysmon event 3 records network connections with the process image. Then compare each process to its normal behavior. A long-lived connection that sends far more than it receives is worth a look.
How to reduce the risk
MITRE lists two mitigations:
- Network intrusion prevention. Signature-based systems can identify traffic for specific adversary malware at the network level. MITRE cautions that signatures are often tied to unique indicators in a protocol or a particular obfuscation technique, and will differ across malware families.
- Data loss prevention. It can detect and block sensitive data sent over unencrypted protocols.
Both have limits when the channel is encrypted and looks ordinary. Egress filtering, so that hosts reach only the destinations they need, narrows what a command channel can use.
