Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Exfiltration Over C2 Channel

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.

ID: T1041

Tactic(s): Exfiltration

Platforms: Linux, macOS, Windows

Data Sources: Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow

Version: 2.1

Created: 31 May 2017

Last Modified: 15 Oct 2021

Name	Description
Procedure Examples
MechaFlounder	MechaFlounder has the ability to send the compromised user's account name and hostname within a URL to C2.(Citation: Unit 42 MechaFlounder March 2019)
PoetRAT	PoetRAT has exfiltrated data over the C2 channel.(Citation: Talos PoetRAT October 2020)
ShimRatReporter	ShimRatReporter sent generated reports to the C2 via HTTP POST requests.(Citation: FOX-IT May 2016 Mofang)
Shark	Shark has the ability to upload files from the compromised host over a DNS or HTTP C2 channel.(Citation: ClearSky Siamesekitten August 2021)
SLOTHFULMEDIA	SLOTHFULMEDIA has sent system information to a C2 server via HTTP and HTTPS POST requests.(Citation: CISA MAR SLOTHFULMEDIA October 2020)
OutSteel	OutSteel can upload files from a compromised host over its C2 channel.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
Bandook	Bandook can upload files from a victim's machine over the C2 channel.(Citation: CheckPoint Bandook Nov 2020)
HotCroissant	HotCroissant has the ability to download files from the infected host to the command and control (C2) server.(Citation: Carbon Black HotCroissant April 2020)
DnsSystem	DnsSystem can exfiltrate collected data to its C2 server.(Citation: Zscaler Lyceum DnsSystem June 2022)
Machete	Machete's collected data is exfiltrated over the same channel used for C2.(Citation: ESET Machete July 2019)
Bumblebee	Bumblebee can send collected data in JSON format to C2.(Citation: Google EXOTIC LILY March 2022)
AppleJeus	AppleJeus has exfiltrated collected host information to a C2 server.(Citation: CISA AppleJeus Feb 2021)
WarzoneRAT	WarzoneRAT can send collected victim data to its C2 server.(Citation: Check Point Warzone Feb 2020)
Torisma	Torisma can send victim data to an actor-controlled C2 server.(Citation: McAfee Lazarus Nov 2020)
SUGARDUMP	SUGARDUMP has sent stolen credentials and other data to its C2 server.(Citation: Mandiant UNC3890 Aug 2022)
Squirrelwaffle	Squirrelwaffle has exfiltrated victim data using HTTP POST requests to its C2 servers.(Citation: ZScaler Squirrelwaffle Sep 2021)
Sandworm Team	Sandworm Team has sent system information to its C2 server using HTTP.(Citation: ESET Telebots Dec 2016)
Chimera	Chimera has used Cobalt Strike C2 beacons for data exfiltration.(Citation: NCC Group Chimera January 2021)
FoggyWeb	FoggyWeb can remotely exfiltrate sensitive information from a compromised AD FS server.(Citation: MSTIC FoggyWeb September 2021)
Carberp	Carberp has exfiltrated data via HTTP to already established C2 servers.(Citation: Prevx Carberp March 2011)(Citation: Trusteer Carberp October 2010)
Misdat	Misdat has uploaded files and data to its C2 servers.(Citation: Cylance Dust Storm)
StrongPity	StrongPity can exfiltrate collected documents through C2 channels.(Citation: Talos Promethium June 2020)(Citation: Bitdefender StrongPity June 2020)
NETEAGLE	NETEAGLE is capable of reading files over the C2 channel.(Citation: FireEye APT30)
GALLIUM	GALLIUM used Web shells and HTRAN for C2 and to exfiltrate data.(Citation: Cybereason Soft Cell June 2019)
Higaisa	Higaisa exfiltrated data over its C2 channel.(Citation: Zscaler Higaisa 2020)
XCSSET	XCSSET exfiltrates data stolen from a system over its C2 channel.(Citation: trendmicro xcsset xcode project 2020)
Empire	Empire can send data gathered from a target through the command and control channel.(Citation: Github PowerShell Empire)(Citation: Talos Frankenstein June 2019)
Pupy	Pupy can send screenshots files, keylogger data, files, and recorded audio back to the C2 server.(Citation: GitHub Pupy)
LightNeuron	LightNeuron exfiltrates data over its email C2 channel.(Citation: ESET LightNeuron May 2019)
Grandoreiro	Grandoreiro can send data it retrieves to the C2 server.(Citation: ESET Grandoreiro April 2020)
TrickBot	TrickBot can send information about the compromised host and upload data to a hardcoded C2 server.(Citation: Cyberreason Anchor December 2019)(Citation: Bitdefender Trickbot VNC module Whitepaper 2021)
STARWHALE	STARWHALE can exfiltrate collected data to its C2 servers.(Citation: DHS CISA AA22-055A MuddyWater February 2022)
BLUELIGHT	BLUELIGHT has exfiltrated data over its C2 channel.(Citation: Volexity InkySquid BLUELIGHT August 2021)
QakBot	QakBot can send stolen information to C2 nodes including passwords, accounts, and emails.(Citation: Kaspersky QakBot September 2021)
Ursnif	Ursnif has used HTTP POSTs to exfil gathered information.(Citation: TrendMicro Ursnif Mar 2015)(Citation: FireEye Ursnif Nov 2017)(Citation: ProofPoint Ursnif Aug 2016)
Frankenstein	Frankenstein has collected information via Empire, which is automatically sent the data back to the adversary's C2.(Citation: Talos Frankenstein June 2019)
Cannon	Cannon exfiltrates collected data over email via SMTP/S and POP3/S C2 channels.(Citation: Unit42 Cannon Nov 2018)
CharmPower	CharmPower can exfiltrate gathered data to a hardcoded C2 URL via HTTP POST.(Citation: Check Point APT35 CharmPower January 2022)
Octopus	Octopus has uploaded stolen files and data from a victim's machine over its C2 channel.(Citation: Securelist Octopus Oct 2018)
S-Type	S-Type has uploaded data and files from a compromised host to its C2 servers.(Citation: Cylance Dust Storm)
Ke3chang	Ke3chang transferred compressed and encrypted RAR files containing exfiltration through the established backdoor command and control channel during operations.(Citation: Mandiant Operation Ke3chang November 2014)
APT39	APT39 has exfiltrated stolen victim data through C2 communications.(Citation: FBI FLASH APT39 September 2020)
Metamorfo	Metamorfo can send the data it collects to the C2 server.(Citation: ESET Casbaneiro Oct 2019)
REvil	REvil can exfiltrate host and malware information to C2 servers.(Citation: Secureworks REvil September 2019)
MobileOrder	MobileOrder exfiltrates data to its C2 server over the same protocol as C2 communications.(Citation: Scarlet Mimic Jan 2016)
Emotet	Emotet has been seen exfiltrating system information stored within cookies sent within an HTTP GET request back to its C2 servers. (Citation: Trend Micro Emotet Jan 2019)
Lazarus Group	Lazarus Group has exfiltrated data and files over a C2 channel through its various tools and malware.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Loaders)(Citation: McAfee Lazarus Resurfaces Feb 2018)(Citation: McAfee Lazarus Nov 2020)
Amadey	Amadey has sent victim data to its C2 servers.(Citation: BlackBerry Amadey 2020)
GoldenSpy	GoldenSpy has exfiltrated host environment information to an external C2 domain via port 9006.(Citation: Trustwave GoldenSpy June 2020)
DustySky	DustySky has exfiltrated data to the C2 server.(Citation: Kaspersky MoleRATs April 2019)
Zebrocy	Zebrocy has exfiltrated data to the designated C2 server using HTTP POST requests.(Citation: Accenture SNAKEMACKEREL Nov 2018)(Citation: CISA Zebrocy Oct 2020)
Remexi	Remexi performs exfiltration over BITSAdmin, which is also used for the C2 channel.(Citation: Securelist Remexi Jan 2019)
Doki	Doki has used Ngrok to establish C2 and exfiltrate data.(Citation: Intezer Doki July 20)
Kevin	Kevin can send data from the victim host through a DNS C2 channel.(Citation: Kaspersky Lyceum October 2021)
IceApple	IceApple's Multi File Exfiltrator module can exfiltrate multiple files from a compromised host as an HTTP response over C2.(Citation: CrowdStrike IceApple May 2022)
TajMahal	TajMahal has the ability to send collected files over its C2.(Citation: Kaspersky TajMahal April 2019)
AuTo Stealer	AuTo Stealer can exfiltrate data over actor-controlled C2 servers via HTTP or TCP.(Citation: MalwareBytes SideCopy Dec 2021)
APT3	APT3 has a tool that exfiltrates data over the C2 channel.(Citation: FireEye Clandestine Fox)
	During Operation Honeybee, the threat actors uploaded stolen files to their C2 servers.(Citation: McAfee Honeybee)
FunnyDream	FunnyDream can execute commands, including gathering user information, and send the results to C2.(Citation: Bitdefender FunnyDream Campaign November 2020)
APT32	APT32's backdoor has exfiltrated data using the already opened channel with its C&C server.(Citation: ESET OceanLotus Mar 2019)
Stuxnet	Stuxnet sends compromised victim information via HTTP.(Citation: Symantec W.32 Stuxnet Dossier)
HOPLIGHT	HOPLIGHT has used its C2 channel to exfiltrate data.(Citation: US-CERT HOPLIGHT Apr 2019)
Okrum	Data exfiltration is done by Okrum using the already opened channel with the C2 server.(Citation: ESET Okrum July 2019)
Astaroth	Astaroth exfiltrates collected information from its r1.log file to the external C2 server. (Citation: Cybereason Astaroth Feb 2019)
Crimson	Crimson can exfiltrate stolen information over its C2.(Citation: Cisco Talos Transparent Tribe Education Campaign July 2022)
HAWKBALL	HAWKBALL has sent system information and files over the C2 channel.(Citation: FireEye HAWKBALL Jun 2019)
Lokibot	Lokibot has the ability to initiate contact with command and control (C2) to exfiltrate stolen data.(Citation: FSecure Lokibot November 2019)
ROKRAT	ROKRAT can send collected files back over same C2 channel.(Citation: Talos ROKRAT)
BoxCaon	BoxCaon uploads files and data from a compromised host over the existing C2 channel.(Citation: Checkpoint IndigoZebra July 2021)
ThiefQuest	ThiefQuest exfiltrates targeted file extensions in the `/Users/` folder to the command and control server via unencrypted HTTP. Network packets contain a string with two pieces of information: a file path and the contents of the file in a base64 encoded string.(Citation: wardle evilquest partii)(Citation: reed thiefquest ransomware analysis)
Attor	Attor has exfiltrated data over the C2 channel.(Citation: ESET Attor Oct 2019)
Cyclops Blink	Cyclops Blink has the ability to upload exfiltrated files to a C2 server.(Citation: NCSC Cyclops Blink February 2022)
EVILNUM	EVILNUM can upload files over the C2 channel from the infected host.(Citation: Prevailion EvilNum May 2020)
BLINDINGCAN	BLINDINGCAN has sent user and system information to a C2 server via HTTP POST requests.(Citation: NHS UK BLINDINGCAN Aug 2020)(Citation: US-CERT BLINDINGCAN Aug 2020)
MarkiRAT	MarkiRAT can exfiltrate locally stored data via its C2.(Citation: Kaspersky Ferocious Kitten Jun 2021)
MacMa	MacMa exfiltrates data from a supplied path over its C2 channel.(Citation: ESET DazzleSpy Jan 2022)
Valak	Valak has the ability to exfiltrate data over the C2 channel.(Citation: Cybereason Valak May 2020)(Citation: Unit 42 Valak July 2020)(Citation: SentinelOne Valak June 2020)
PowerShower	PowerShower has used a PowerShell document stealer module to pack and exfiltrate .txt, .pdf, .xls or .doc files smaller than 5MB that were modified during the past two days.(Citation: Kaspersky Cloud Atlas August 2019)
StrifeWater	StrifeWater can send data and files from a compromised host to its C2 server.(Citation: Cybereason StrifeWater Feb 2022)
Kimsuky	Kimsuky has exfiltrated data over its C2 channel.(Citation: Securelist Kimsuky Sept 2013)(Citation: Talos Kimsuky Nov 2021)
BACKSPACE	Adversaries can direct BACKSPACE to upload files to the C2 Server.(Citation: FireEye APT30)
Chrommme	Chrommme can exfiltrate collected data via C2.(Citation: ESET Gelsemium June 2021)
Industroyer	Industroyer sends information about hardware profiles and previously-received commands back to the C2 server in a POST-request.(Citation: ESET Industroyer)
SombRAT	SombRAT has uploaded collected data and files from a compromised host to its C2 server.(Citation: BlackBerry CostaRicto November 2020)
FlawedAmmyy	FlawedAmmyy has sent data collected from a compromised host to its C2 servers.(Citation: Korean FSI TA505 2020)
ZIRCONIUM	ZIRCONIUM has exfiltrated files via the Dropbox API C2.(Citation: Zscaler APT31 Covid-19 October 2020)
SMOKEDHAM	SMOKEDHAM has exfiltrated data to its C2 server.(Citation: FireEye SMOKEDHAM June 2021)
Flagpro	Flagpro has exfiltrated data to the C2 server.(Citation: NTT Security Flagpro new December 2021)
AppleSeed	AppleSeed can exfiltrate files via the C2 channel.(Citation: Malwarebytes Kimsuky June 2021)
SILENTTRINITY	SILENTTRINITY can transfer files from an infected host to the C2 server.(Citation: GitHub SILENTTRINITY Modules July 2019)
Drovorub	Drovorub can exfiltrate files over C2 infrastructure.(Citation: NSA/FBI Drovorub August 2020)
Caterpillar WebShell	Caterpillar WebShell can upload files over the C2 channel.(Citation: ClearSky Lebanese Cedar Jan 2021)
	During Operation Wocao, threat actors used the XServer backdoor to exfiltrate data.(Citation: FoxIT Wocao December 2019)
Imminent Monitor	Imminent Monitor has uploaded a file containing debugger logs, network information and system information to the C2.(Citation: QiAnXin APT-C-36 Feb2019)
Psylo	Psylo exfiltrates data to its C2 server over the same protocol as C2 communications.(Citation: Scarlet Mimic Jan 2016)
Pteranodon	Pteranodon exfiltrates screenshot files to its C2 server.(Citation: Palo Alto Gamaredon Feb 2017)
Kessel	Kessel has exfiltrated information gathered from the infected system to the C2 server.(Citation: ESET ForSSHe December 2018)
SideTwist	SideTwist has exfiltrated data over its C2 channel.(Citation: Check Point APT34 April 2021)
SDBbot	SDBbot has sent collected data from a compromised host to its C2 servers.(Citation: Korean FSI TA505 2020)
Confucius	Confucius has exfiltrated stolen files to its C2 server.(Citation: TrendMicro Confucius APT Aug 2021)
Bisonal	Bisonal has added the exfiltrated data to the URL over the C2 channel.(Citation: Talos Bisonal Mar 2020)
Rising Sun	Rising Sun can send data gathered from the infected machine via HTTP POST request to the C2.(Citation: McAfee Sharpshooter December 2018)
njRAT	njRAT has used HTTP to receive stolen information from the infected machine.(Citation: Trend Micro njRAT 2018)
KGH_SPY	KGH_SPY can exfiltrate collected information from the host to the C2 server.(Citation: Cybereason Kimsuky November 2020)
Mongall	Mongall can upload files and information from a compromised host to its C2 server.(Citation: SentinelOne Aoqin Dragon June 2022)
Wizard Spider	Wizard Spider has exfiltrated domain credentials and network enumeration information over command and control (C2) channels.(Citation: CrowdStrike Grim Spider May 2019)
Proxysvc	Proxysvc performs data exfiltration over the control server channel using a custom protocol.(Citation: McAfee GhostSecret)
KONNI	KONNI has sent data and files to its C2 server.(Citation: Talos Konni May 2017)(Citation: Malwarebytes Konni Aug 2021)(Citation: Malwarebytes KONNI Evolves Jan 2022)
Sliver	Sliver can exfiltrate files from the victim using the `download` command.(Citation: GitHub Sliver Download)
PcShare	PcShare can upload files and information from a compromised host to its C2 servers.(Citation: Bitdefender FunnyDream Campaign November 2020)
Tomiris	Tomiris can upload files matching a hardcoded set of extensions, such as .doc, .docx, .pdf, and .rar, to its C2 server.(Citation: Kaspersky Tomiris Sep 2021)
Penquin	Penquin can execute the command code `do_upload` to send files to C2.(Citation: Leonardo Turla Penquin May 2020)
CreepySnail	CreepySnail can connect to C2 for data exfiltration.(Citation: Microsoft POLONIUM June 2022)
Bankshot	Bankshot exfiltrates data over its C2 channel.(Citation: McAfee Bankshot)
	During Frankenstein, the threat actors collected information via Empire, which sent the data back to the adversary's C2.(Citation: Talos Frankenstein June 2019)
Leviathan	Leviathan has exfiltrated data over its C2 channel.(Citation: CISA AA21-200A APT40 July 2021)
Mis-Type	Mis-Type has transmitted collected files and data to its C2 server.(Citation: Cylance Dust Storm)
RDAT	RDAT can exfiltrate data gathered from the infected system via the established Exchange Web Services API C2 channel.(Citation: Unit42 RDAT July 2020)
Gamaredon Group	A Gamaredon Group file stealer can transfer collected files to a hardcoded C2 server.(Citation: Palo Alto Gamaredon Feb 2017)
LitePower	LitePower can send collected data, including screenshots, over its C2 channel.(Citation: Kaspersky WIRTE November 2021)
Spark	Spark has exfiltrated data over the C2 channel.(Citation: Unit42 Molerat Mar 2020)
ADVSTORESHELL	ADVSTORESHELL exfiltrates data over the same channel used for C2.(Citation: ESET Sednit Part 2)
Operation Wocao	Operation Wocao has used the Xserver backdoor to exfiltrate data.(Citation: FoxIT Wocao December 2019)
Goopy	Goopy has the ability to exfiltrate data over the Microsoft Outlook C2 channel.(Citation: Cybereason Cobalt Kitty 2017)
CallMe	CallMe exfiltrates data to its C2 server over the same protocol as C2 communications.(Citation: Scarlet Mimic Jan 2016)
GoldMax	GoldMax can exfiltrate files over the existing C2 channel.(Citation: MSTIC NOBELIUM Mar 2021)(Citation: FireEye SUNSHUTTLE Mar 2021)
MuddyWater	MuddyWater has used C2 infrastructure to receive exfiltrated data.(Citation: Reaqta MuddyWater November 2017)
Stealth Falcon	After data is collected by Stealth Falcon malware, it is exfiltrated over the existing C2 channel.(Citation: Citizen Lab Stealth Falcon May 2016)
Ebury	Ebury can exfiltrate SSH credentials through custom DNS queries.(Citation: ESET Windigo Mar 2014)
ZLib	ZLib has sent data and files from a compromised host to its C2 servers.(Citation: Cylance Dust Storm)
Dyre	Dyre has the ability to send information staged on a compromised host externally to C2.(Citation: Malwarebytes Dyreza November 2015)
GrimAgent	GrimAgent has sent data related to a compromise host over its C2 channel.(Citation: Group IB GrimAgent July 2021)
PingPull	PingPull has the ability to exfiltrate stolen victim data through its C2 channel.(Citation: Unit 42 PingPull Jun 2022)
Crutch	Crutch can exfiltrate data over the primary C2 channel (Dropbox HTTP API).(Citation: ESET Crutch December 2020)
OopsIE	OopsIE can upload files from the victim's machine to its C2 server.(Citation: Unit 42 OopsIE! Feb 2018)

Mitigation	Description
Mitigations
Network Intrusion Prevention	Use intrusion detection signatures to block traffic at network boundaries.
Exfiltration Over Command and Control Channel Mitigation	Mitigations for command and control apply. Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool command and control signatures over time or construct protocols in such a way to avoid detection by common defensive tools. (Citation: University of Birmingham C2)
Data Loss Prevention	Use a data loss prevention (DLP) strategy to categorize sensitive data, identify data formats indicative of personal identifiable information (PII), and restrict exfiltration of sensitive data.(Citation: PurpleSec Data Loss Prevention)

Detection

Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2)

References

Связанные риски

Риск	Связи
Передача данных по скрытым каналам из-за возможности маскировки вредоносного трафика под легитимный в сетевом трафике Конфиденциальность Раскрытие информации
Несанкционированное управление ИТ инфраструктурой из-за возможности маскировки вредоносного трафика под легитимный в сетевом трафике Повышение привилегий Целостность НСД
Утечка информации из-за возможности маскировки вредоносного трафика под легитимный в сетевом трафике Конфиденциальность Раскрытие информации

Каталоги

Техники ATT&CK:

T1001.003 Data Obfuscation: Protocol Impersonation

T1029 Scheduled Transfer

T1095 Non-Application Layer Protocol

T1102.001 Web Service: Dead Drop Resolver

T1102.002 Web Service: Bidirectional Communication

T1102.003 Web Service: One-Way Communication

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.

Exfiltration Over C2 Channel

Procedure Examples

Mitigations

Detection

References

Связанные риски

Каталоги