T1041: Exfiltration Over C2 Channel

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.

Positive Technologies products that cover the technique

MaxPatrol SIEM knowledge base

Monitoring of events related to processes allowing data exfiltration over a C2 channel. For example, an adversary may use dnscat2.exe or the Start-Dnscat2 PowerShell cmdlet.

Expert Required. The technique is detected only with the combination of «PT Product + Expert»

Detection

IDDS0017Data source and componentCommand: Command ExecutionDescription

Monitor executed commands and arguments that may steal data by exfiltrating it over an existing command and control channel.

IDDS0022Data source and componentFile: File AccessDescription

Monitor for suspicious files (i.e. .pdf, .docx, .jpg, etc.) viewed in isolation that may steal data by exfiltrating it over an existing command and control channel.

IDDS0029Data source and componentNetwork Traffic: Network Connection CreationDescription

Monitor for newly constructed network connections that are sent or received by untrusted hosts.

Note: Network Analysis frameworks such as Zeek can be used to capture, decode, and alert on TCP network connection creation.

IDDS0029Data source and componentNetwork Traffic: Network Traffic ContentDescription

Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)).

IDDS0029Data source and componentNetwork Traffic: Network Traffic FlowDescription

Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.

Mitigation

IDM1031NameNetwork Intrusion PreventionDescription

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool command and control signatures over time or construct protocols in such a way to avoid detection by common defensive tools.

IDM1057NameData Loss PreventionDescription

Data loss prevention can detect and block sensitive data being sent over unencrypted protocols.