CyberStack

MITRE ATT&CK / Techniques / T1041

Exfiltration Over C2 Channel

ID
T1041
Tactics
TA0010 Exfiltration
Platforms
ESXi, Linux, macOS, Windows
Data sources
Process Creation, Network Connection Creation, Network Traffic Content, File Access, Network Traffic Flow
Source
attack.mitre.org
MITRE last modified
12 Sep 2026

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.[2]

Detection

Mitigations (2)

M1031 Network Intrusion Prevention

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool command and control signatures over time or construct protocols in such a way to avoid detection by common defensive tools. [1]

M1057 Data Loss Prevention

Data loss prevention can detect and block sensitive data being sent over unencrypted protocols.

Groups (28)

Software (173)

Showing 60 of 173. Full list on attack.mitre.org.

References

  1. University of Birmingham C2
  2. C2 FRAMEWORKS