Home/ MITRE Matrix/ Exfiltration/ T1048.003

T1048.003Exfiltration Over Unencrypted Non-C2 Protocol

T1048.003 — Exfiltration Over Unencrypted Non-C2 Protocol is a MITRE ATT&CK technique in the Exfiltration tactic. Clankerusecase tracks 19 detection use cases covering it and 11 threat-intel articles citing it.

Exfiltration

View on the matrix → Filter Detection Library MITRE official spec ↗

19Use cases

11Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1048 · Exfiltration Over Alternative Protocol

Use cases covering this technique (19)

DNS tunneling / TXT-heavy domain queries Internal c2 · hunting DSP Cisco ASA - Device File Copy to Remote Location ESCU actions · hunting P Gsuite Outbound Email With Attachment To External Domain ESCU actions · hunting P Linux Shell Pseudo Device Reverse Shell ESCU actions · hunting P Windows Rundll32 WebDAV Request ESCU actions · hunting P Windows Rundll32 WebDav With Network Connection ESCU actions · alerting P Cisco Secure Firewall - Potential Data Exfiltration ESCU actions · hunting P DNS Query Length With High Standard Deviation ESCU actions · hunting P Protocol or Port Mismatch ESCU actions · hunting P Multiple Archive Files Http Post Traffic ESCU actions · alerting P Plain HTTP POST Exfiltrated Data ESCU actions · alerting P Clients Connecting to Multiple DNS Servers ESCU actions · alerting P Detect DNS Data Exfiltration using pretrained model in DSDL ESCU actions · hunting P Detect Long DNS TXT Record Response ESCU actions · alerting P Detection of DNS Tunnels ESCU actions · alerting P [LLM] DNS TXT/NULL record C2 & exfiltration: high-volume rare-record-type queries from one host Bespoke actions · hunting SPCS [LLM] DNS tunneling exfiltration pattern to *.t.opentensor-cdn.com (hex chunk/index/total/session) Bespoke c2 · alerting DSΣPDD [LLM] npm/node install hook exfiltrating /etc/passwd, kube config & krb5 ticket via wget --post-file Bespoke actions · alerting DSΣPDDCS [LLM] Outbound connection/DNS to npm exfil endpoint entfet95itcxpuu.m.pipedream.net Bespoke c2 · alerting DSΣPCS

Articles citing this technique (11)

crit Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic art-10

crit China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud art-49

high Project CAV3RN continues: Google Apps Script as C2 relay and DNS-based C2 channel selection art-91

crit Network Anomaly Detection in KATA art-159

crit OceanLotus: From external espionage to domestic targeting art-388

high Nx Console VS Code Extension Compromised art-419

crit 5 Supply Chain Attacks in 48 Hours: Why Securing One Layer Is Not Enough art-452

crit Active Supply Chain Attack: Malicious node-ipc Versions Published to npm art-473

crit bittensor-wallet 4.0.2 Compromised on PyPI - Backdoor Exfiltrates Private Keys art-594

crit Understanding DNS attacks: Identifying and patching vulnerabilities art-1972

high Snyk uncovers malicious code activities in open source supply chain security on the npm registry art-3190