// MITRE ATT&CK
T1048 · Exfiltration Over Alternative Protocol
Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other...
¿Cómo detectarlo y mitigarlo?
La detección de Exfiltration Over Alternative Protocol parte de la telemetría de tu SIEM/EDR. Escribe una regla de detección con el generador Sigma, analiza logs sospechosos en el analizador de logs y sitúa la técnica en tu cobertura con la matriz ATT&CK.
Sub-técnicas (3)
T1048.001
Exfiltration Over Symmetric Encrypted Non-C2 Protocol T1048.002
Exfiltration Over Asymmetric Encrypted Non-C2 Protocol T1048.003
Exfiltration Over Unencrypted Non-C2 Protocol
Exfiltration Over Symmetric Encrypted Non-C2 Protocol T1048.002
Exfiltration Over Asymmetric Encrypted Non-C2 Protocol T1048.003
Exfiltration Over Unencrypted Non-C2 Protocol
Técnicas relacionadas
T1567
Exfiltration Over Web Service T1567.004
Exfiltration Over Webhook T1029
Scheduled Transfer T1011
Exfiltration Over Other Network Medium T1011.001
Exfiltration Over Bluetooth T1020
Automated Exfiltration T1048.001
Exfiltration Over Symmetric Encrypted Non-C2 Protocol T1020.001
Traffic Duplication
Exfiltration Over Web Service T1567.004
Exfiltration Over Webhook T1029
Scheduled Transfer T1011
Exfiltration Over Other Network Medium T1011.001
Exfiltration Over Bluetooth T1020
Automated Exfiltration T1048.001
Exfiltration Over Symmetric Encrypted Non-C2 Protocol T1020.001
Traffic Duplication
Fuente: MITRE ATT&CK®. ATT&CK es una marca registrada de The MITRE Corporation. Contenido con fines educativos.