Attackers who already control a host often move the data out over a second channel, such as FTP, TFTP, DNS, SMTP or a separately encrypted session, precisely because defenders are watching the first one. MITRE ATT&CK tracks this as T1048 Exfiltration Over Alternative Protocol: stealing data over a protocol other than the existing command and control channel, sometimes to a different network location. This guide covers the three sub-techniques in ATT&CK v20, the protocol by protocol detection logic using endpoint, Zeek, flow, DNS resolver and cloud logs, the egress design that makes most of these channels impossible, and the machine credential angle on network devices and cloud workloads. It is for SOC analysts, detection engineers and network architects, and it is written for defence only. For data theft as a whole, see the Data Exfiltration Guide.
Key takeaways
- Default-deny egress beats every analytic. Servers, network devices and workloads that can only reach named destinations on named ports leave T1048 little room; all six ATT&CK mitigations are about restricting paths and permissions.
- The protocol must match the host's role. FTP from a domain controller, SMTP from a database server or DNS queries that bypass the internal resolver are high-signal on almost any network.
- Volume and shape matter more than content. Encrypted channels hide payloads, so originator bytes, session duration and query length are the usable features.
- Network devices are a blind spot. Salt Typhoon exfiltrated device configurations over TFTP and FTP, and those configurations held SNMP community strings and weakly protected local credentials.
- Cloud copies count too. ATT&CK v20 includes IaaS and SaaS in scope, with CloudTrail GetObject and CopyObject plus VPC Flow Logs as the cloud analytic sources.
How the attack works
ATT&CK v20 places T1048 in the Exfiltration tactic on Windows, Linux, macOS, ESXi, network devices, IaaS, SaaS and Office Suite. The description lists FTP, SMTP, HTTP/S, DNS and SMB as examples, notes that the data may go to a location other than the main C2 server, and that built-in tools such as Net, FTP clients and curl are enough. Data is usually staged and archived first (T1074 Data Staged, T1560 Archive Collected Data).
| Sub-technique | What it means | Typical protocols and ports | Examples recorded in ATT&CK v20 |
|---|---|---|---|
| T1048.001 Symmetric Encrypted Non-C2 Protocol | Data encrypted with a pre-shared key (for example AES or RC4) before or inside the transfer, sometimes inside HTTPS as a second layer | Any, including HTTP and FTP carrying ciphertext | No groups or software recorded |
| T1048.002 Asymmetric Encrypted Non-C2 Protocol | Data sent over a protocol with built-in public key encryption, such as TLS, to a destination other than the C2 server | HTTPS 443, SFTP or SCP over SSH 22, FTPS | APT28, APT38, Rclone, SolarWinds Compromise, Storm-1811, MirrorFace |
| T1048.003 Unencrypted Non-C2 Protocol | Data sent in clear or merely encoded (for example base64) over a natively unencrypted protocol, including inside headers and fields | FTP 21, TFTP 69/UDP, HTTP 80, SMTP 25, DNS 53 | 35 entries including Salt Typhoon, OilRig, FIN6, FIN8, Lazarus Group, Wizard Spider, BITSAdmin |
T1048 differs from T1567 Exfiltration Over Web Service, where the destination is a legitimate third-party service, and from T1041 Exfiltration Over C2 Channel. DNS tunnelling used for command and control is T1071.004 or T1572 Protocol Tunneling; it becomes T1048 when DNS is used as a separate exfiltration path. See the T1567 Exfiltration Over Web Service guide.
Where it shows up
- Network infrastructure: Cisco Talos reported that Salt Typhoon often exfiltrated device configurations over TFTP or FTP, exported packet captures with Embedded Packet Capture to an FTP server, and used a loopback interface as the source of SSH connections to bypass ACLs. See the Salt Typhoon telecom intrusions and the Salt Typhoon Threat Actor Profile.
- Ransomware pre-encryption theft: sync tools such as Rclone (recorded under T1048.002 and T1048.003) push archives over SFTP or FTP to operator-controlled servers.
- Cloud workloads: a compromised instance uses its role credentials to read buckets and then sends the data to an external host, or uses DNS lookups to a domain the attacker controls.
- Endpoints and mail: credential stealers that send harvested data by SMTP to an attacker mailbox, a long-standing pattern in commodity malware.
Impact
T1048 is a confidentiality loss with two aggravating factors. Unencrypted channels expose the stolen data again in transit, and network device configurations taken this way are themselves credential stores: SNMP read-write community strings, TACACS+ and RADIUS shared keys and local account hashes. Talos described local accounts with weak password encryption types that could be "trivially" decrypted offline. Each exfiltrated configuration therefore forces a rotation of every machine credential it contained.
Detection
ATT&CK v20 detection strategies DET0131 (parent), DET0503, DET0512 and DET0149 share one shape: data access, staging or compression, followed by outbound traffic from an unexpected process, to a rare destination, on a protocol the host does not normally use. The table gives the high-signal checks per protocol.
| Channel | Log source | High-signal condition |
|---|---|---|
| FTP and TFTP | Zeek conn.log and ftp.log; firewall logs; network device CLI and AAA logs | Any outbound 21 or 69/UDP from servers or devices; "copy running-config" or capture export commands to non-management addresses |
| DNS | Resolver query logs (for example Route 53 Resolver query logging), Zeek dns.log, Sysmon Event ID 22 | Queries that bypass the internal resolver; many unique long subdomains under one parent domain; high query rate from one host to one domain |
| SMTP | Firewall and mail gateway logs; Sysmon Event ID 3 | Port 25 or 587 from hosts that are not mail relays; non-mail processes opening SMTP sessions |
| SSH, SFTP, SCP | auditd execve and connect; Zeek conn.log; ssh.log | scp, sftp or rclone to new external addresses after archiving; long sessions with large orig_bytes |
| TLS to raw IP or rare host | Zeek ssl.log and x509.log; Sysmon 1 and 3 | Non-browser process, self-signed or new certificate, no SNI, large upload |
| Cloud | AWS CloudTrail GetObject and CopyObject (data events); VPC Flow Logs | Bulk object reads by a workload role followed by outbound flows to an address outside expected endpoints |
Analytic notes
- Use originator bytes: in Zeek conn.log, orig_bytes and resp_bytes give payload volume per direction; a sustained high orig_bytes to resp_bytes ratio with a long duration is the core exfiltration feature for encrypted channels.
- Join process to flow: Sysmon Event ID 3 records the image that opened each connection; join it to Event ID 1 command lines and to Event ID 11 archive file creation in the preceding minutes.
- Watch for logging gaps: Talos recommends monitoring syslog and AAA logs for drops in volume, because the actor tried to clear logs along its path.
- Baseline by role, not by host: build servers, backup servers and file transfer gateways legitimately send large volumes; give them their own thresholds rather than exempting them.
See the DNS Logging and Detection Guide and the NetFlow and IPFIX Flow Telemetry Guide.
Prevention and hardening
| Control | ATT&CK or D3FEND | Practical setting |
|---|---|---|
| Default-deny outbound firewall for servers and workloads | M1037, M1030, D3-OTF | Allow only named destinations and ports; force web egress through a proxy |
| Force DNS through controlled resolvers | M1037, D3-DNSTA | Block outbound 53 and known DNS over HTTPS endpoints except from resolvers; on AWS, Route 53 Resolver DNS Firewall can deny all domains except those you trust |
| Restrict SMTP to relays | M1037 | Block 25 and 587 outbound except from mail gateways |
| Disable unused device services | M1030 | Per Talos: "no ip http server", "transport input ssh" on VTY lines, "no vstack", Guest Shell disabled if unused; management ACLs for TFTP and FTP |
| Protect device secrets | M1018 | Type 8 passwords for local accounts, type 6 for TACACS+ keys, SNMPv3 instead of community strings |
| Restrict cloud storage access | M1022, M1018 | Bucket policies and IAM limited to the workloads that need them; data events logged |
| Inline inspection and DLP | M1031, M1057 | Signatures for tunnelling tools; DLP on clear-text protocols |
- Measure first: collect two to four weeks of flow and firewall logs and list every outbound protocol and port per server role.
- Block the easy ones: outbound TFTP, FTP, SMTP and direct DNS from everything except named systems. These rarely have legitimate users.
- Move to allowlists for servers and workloads: start with domain controllers, database servers and network management planes, in alert-only mode for a week, then enforce.
- Harden network devices: apply the Talos service and password settings, centralise configuration storage and restrict file transfer protocols to the management network.
- Roll back with a named change: each rule should be a separate, documented change so a broken business flow can be restored without disabling the whole policy.
Small organisations can get most of the value from a host firewall with outbound default deny on servers and a protective DNS service; large estates need central egress points per region and per cloud account.
Where identity fits
Machine credentials are both the target and the enabler. Network device configurations carry SNMP strings, AAA shared keys and local account hashes; cloud workloads use role credentials to read the data before sending it out. Treat any configuration seen leaving over TFTP or FTP as a credential exposure and rotate what it contained. In cloud, scope workload roles so a compromised instance cannot read buckets it does not need, and alert when a role reads far more objects than usual. See the Cisco IOS XE Hardening Guide and the AWS CloudTrail Guide.
Lessons from incidents
- Clear-text management protocols are an exfiltration path: Salt Typhoon's use of TFTP and FTP for configurations would have been blocked by management plane ACLs and visible in flow data from device interfaces.
- ACLs keyed on source address can be bypassed from inside: the loopback technique Talos described shows why device-to-device SSH should be authenticated and logged, not trusted by address.
- Logs disappear: the same actor cleared logs; forward device syslog and AAA records off-box in real time.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev. 5 | SC-7 Boundary Protection; SC-7(5) Deny by Default, Allow by Exception; SC-7(10) Prevent Exfiltration | Egress allowlisting |
| NIST SP 800-53 Rev. 5 | SI-4(18) Analyze Traffic and Covert Exfiltration; CM-7 Least Functionality | Detection and disabling unused protocols |
| NIST CSF 2.0 | PR.DS-02, DE.CM-01 | Data in transit; network monitoring |
| MITRE ATT&CK v20 | M1030, M1037, M1031, M1057, M1022, M1018 | Listed mitigations |
| MITRE D3FEND | D3-OTF Outbound Traffic Filtering, D3-DNSTA DNS Traffic Analysis | Prevention and detection techniques |
Practitioner checklist
- List outbound protocols and ports per server role, device class and cloud account from flow data.
- Block outbound TFTP, FTP, SMTP and direct DNS except from named systems.
- Force all DNS through controlled resolvers and log every query.
- Collect Sysmon 1, 3, 11 and 22 (or EDR equivalent), auditd execve and connect, and Zeek conn, dns, ssl and ftp logs.
- Alert on high orig_bytes sessions to rare destinations from non-browser processes after archive creation.
- Restrict device file transfers to the management network and forward AAA and syslog off-box.
- Enable CloudTrail data events for sensitive buckets and alert on bulk reads by workload roles.
- Track metrics: share of servers under default-deny egress, number of hosts able to resolve DNS externally, alerts per week on protocol-role mismatch, and time to rotate credentials after a configuration exposure.
Standards and references
- MITRE ATT&CK: Exfiltration Over Alternative Protocol (T1048)
- Cisco Talos: Salt Typhoon analysis of US telecom intrusions
- AWS: Route 53 Resolver DNS Firewall
- Zeek: conn.log documentation
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Data Exfiltration Guide · T1567 Exfiltration Over Web Service · DNS Security Guide · Data Exfiltration Playbook