Exfiltration Over Unencrypted Non-C2 Protocol
Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.(Citation: copy_cmd_cisco) Adversaries may opt to obfuscate this data, without the use of encryption, within network protocols that are natively unencrypted (such as HTTP, FTP, or DNS). This may include custom or publicly available encoding/compression a...
BY SOURCE
PROCEDURES (15)
Auto-extracted: 2 detections for persist
Auto-extracted: 2 detections for encrypt
Auto-extracted: 2 detections for process creation monitoring
Auto-extracted: 2 detections for unusual
Auto-extracted: 2 detections for remote
Auto-extracted: 1 detections for c2
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for dns
Auto-extracted: 1 detections for network connection monitoring
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for email security
Auto-extracted: 1 detections for command and control
Auto-extracted: 1 detections for c2