Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Exfiltration/ T1048

T1048Exfiltration Over Alternative Protocol

T1048 — Exfiltration Over Alternative Protocol is a MITRE ATT&CK technique in the Exfiltration tactic. Clankerusecase tracks 9 detection use cases covering it and 3 threat-intel articles citing it.

Exfiltration
View on the matrix → Filter Detection Library MITRE official spec ↗
9Use cases
3Articles
3Sub-techniques
1Tactic

Sub-techniques (3)

T1048.002 · Exfiltration Over Asymmetric Encrypted Non-C2 ProtocolT1048.001 · Exfiltration Over Symmetric Encrypted Non-C2 ProtocolT1048.003 · Exfiltration Over Unencrypted Non-C2 Protocol

Use cases covering this technique (9)

[WEEKLY] Dev/CI Toolchain Credential Read + Egress to Non-Canonical Registry Internal actions · alerting DSPDDCS Ollama Possible Model Exfiltration Data Leakage ESCU actions · hunting P O365 DLP Rule Triggered ESCU actions · hunting P DNS Exfiltration Using Nslookup App ESCU actions · alerting P Excessive Usage of NSLOOKUP App ESCU actions · hunting P Prohibited Network Traffic Allowed ESCU actions · alerting P [LLM] rclone data-exfiltration staging prior to Sinobi encryption Bespoke actions · alerting DSΣDDCS [LLM] Build/attestation process egress to non-canonical OCI registry (@sigstore/oci cred leak, CVE-2026-59891) Bespoke actions · hunting DSPCS [LLM] npm dropper DNS exfil to pkgio.com / game-note.com (gxm-reference campaign) Bespoke c2 · alerting DSΣPCS

Articles citing this technique (3)

crit IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains art-188
crit [GHSA / CRITICAL] CVE-2026-59891: Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry art-235
crit Targeted npm dependency confusion attack caught red-handed art-2296