Esc
Exfiltration Over Alternative Protocol - T1048

(ATT&CK® Technique)
Subtechniques

Definition

Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
D3FEND Inferred Relationships

Browse the D3FEND knowledge graph by clicking on the nodes below.
        graph LR;

     T1048["Exfiltration Over Alternative Protocol"] --> |produces| InternetNetworkTraffic["Internet Network Traffic"]; class T1048 OffensiveTechniqueNode;
        class InternetNetworkTraffic ArtifactNode; click InternetNetworkTraffic href "/dao/artifact/d3f:InternetNetworkTraffic";
        click T1048 href "/offensive-technique/attack/T1048/"; click InternetNetworkTraffic href "/dao/artifact/d3f:InternetNetworkTraffic"; T1048["Exfiltration Over Alternative Protocol"] --> |may-transfer| CertificateFile["Certificate File"]; class T1048 OffensiveTechniqueNode;
        class CertificateFile ArtifactNode; click CertificateFile href "/dao/artifact/d3f:CertificateFile";
        click T1048 href "/offensive-technique/attack/T1048/"; click CertificateFile href "/dao/artifact/d3f:CertificateFile"; T1048["Exfiltration Over Alternative Protocol"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1048 OffensiveTechniqueNode;
        class OutboundInternetNetworkTraffic ArtifactNode; click OutboundInternetNetworkTraffic href "/dao/artifact/d3f:OutboundInternetNetworkTraffic";
        click T1048 href "/offensive-technique/attack/T1048/"; click OutboundInternetNetworkTraffic href "/dao/artifact/d3f:OutboundInternetNetworkTraffic"; T1048["Exfiltration Over Alternative Protocol"] --> |produces| OutboundInternetEncryptedTraffic["Outbound Internet Encrypted Traffic"]; class T1048 OffensiveTechniqueNode;
        class OutboundInternetEncryptedTraffic ArtifactNode; click OutboundInternetEncryptedTraffic href "/dao/artifact/d3f:OutboundInternetEncryptedTraffic";
        click T1048 href "/offensive-technique/attack/T1048/"; click OutboundInternetEncryptedTraffic href "/dao/artifact/d3f:OutboundInternetEncryptedTraffic";                                                    PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] -->
          | analyzes | InternetNetworkTraffic["Internet Network Traffic"];

          PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] -.->
            | May Detect | T1048["Exfiltration Over Alternative Protocol"] ;
          class PerHostDownload-UploadRatioAnalysis DefensiveTechniqueNode;
          class InternetNetworkTraffic ArtifactNode;
          click PerHostDownload-UploadRatioAnalysis href "/technique/d3f:PerHostDownload-UploadRatioAnalysis"; PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] -->
          | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"];

          
          class PerHostDownload-UploadRatioAnalysis DefensiveTechniqueNode;
          class OutboundInternetNetworkTraffic ArtifactNode;
          click PerHostDownload-UploadRatioAnalysis href "/technique/d3f:PerHostDownload-UploadRatioAnalysis"; PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] -->
          | analyzes | OutboundInternetEncryptedTraffic["Outbound Internet Encrypted Traffic"];

          
          class PerHostDownload-UploadRatioAnalysis DefensiveTechniqueNode;
          class OutboundInternetEncryptedTraffic ArtifactNode;
          click PerHostDownload-UploadRatioAnalysis href "/technique/d3f:PerHostDownload-UploadRatioAnalysis"; ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] -->
          | analyzes | InternetNetworkTraffic["Internet Network Traffic"];

          ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] -.->
            | May Detect | T1048["Exfiltration Over Alternative Protocol"] ;
          class ProtocolMetadataAnomalyDetection DefensiveTechniqueNode;
          class InternetNetworkTraffic ArtifactNode;
          click ProtocolMetadataAnomalyDetection href "/technique/d3f:ProtocolMetadataAnomalyDetection"; RemoteTerminalSessionDetection["Remote Terminal Session Detection"] -->
          | analyzes | InternetNetworkTraffic["Internet Network Traffic"];

          RemoteTerminalSessionDetection["Remote Terminal Session Detection"] -.->
            | May Detect | T1048["Exfiltration Over Alternative Protocol"] ;
          class RemoteTerminalSessionDetection DefensiveTechniqueNode;
          class InternetNetworkTraffic ArtifactNode;
          click RemoteTerminalSessionDetection href "/technique/d3f:RemoteTerminalSessionDetection";               RemoteTerminalSessionDetection["Remote Terminal Session Detection"] -->
          | analyzes | OutboundInternetEncryptedTraffic["Outbound Internet Encrypted Traffic"];

          
          class RemoteTerminalSessionDetection DefensiveTechniqueNode;
          class OutboundInternetEncryptedTraffic ArtifactNode;
          click RemoteTerminalSessionDetection href "/technique/d3f:RemoteTerminalSessionDetection";                                          NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] -->
          | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"];

          NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] -.->
            | May Detect | T1048["Exfiltration Over Alternative Protocol"] ;
          class NetworkTrafficCommunityDeviation DefensiveTechniqueNode;
          class OutboundInternetNetworkTraffic ArtifactNode;
          click NetworkTrafficCommunityDeviation href "/technique/d3f:NetworkTrafficCommunityDeviation"; NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] -->
          | analyzes | OutboundInternetEncryptedTraffic["Outbound Internet Encrypted Traffic"];

          
          class NetworkTrafficCommunityDeviation DefensiveTechniqueNode;
          class OutboundInternetEncryptedTraffic ArtifactNode;
          click NetworkTrafficCommunityDeviation href "/technique/d3f:NetworkTrafficCommunityDeviation"; NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] -->
          | analyzes | InternetNetworkTraffic["Internet Network Traffic"];

          NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] -.->
            | May Detect | T1048["Exfiltration Over Alternative Protocol"] ;
          class NetworkTrafficSignatureAnalysis DefensiveTechniqueNode;
          class InternetNetworkTraffic ArtifactNode;
          click NetworkTrafficSignatureAnalysis href "/technique/d3f:NetworkTrafficSignatureAnalysis"; NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] -->
          | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"];

          
          class NetworkTrafficSignatureAnalysis DefensiveTechniqueNode;
          class OutboundInternetNetworkTraffic ArtifactNode;
          click NetworkTrafficSignatureAnalysis href "/technique/d3f:NetworkTrafficSignatureAnalysis"; NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] -->
          | analyzes | OutboundInternetEncryptedTraffic["Outbound Internet Encrypted Traffic"];

          
          class NetworkTrafficSignatureAnalysis DefensiveTechniqueNode;
          class OutboundInternetEncryptedTraffic ArtifactNode;
          click NetworkTrafficSignatureAnalysis href "/technique/d3f:NetworkTrafficSignatureAnalysis";                NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] -->
          | analyzes | InternetNetworkTraffic["Internet Network Traffic"];

          
          class NetworkTrafficCommunityDeviation DefensiveTechniqueNode;
          class InternetNetworkTraffic ArtifactNode;
          click NetworkTrafficCommunityDeviation href "/technique/d3f:NetworkTrafficCommunityDeviation";                                                ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] -->
          | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"];

          
          class ProtocolMetadataAnomalyDetection DefensiveTechniqueNode;
          class OutboundInternetNetworkTraffic ArtifactNode;
          click ProtocolMetadataAnomalyDetection href "/technique/d3f:ProtocolMetadataAnomalyDetection";                DecoyFile["Decoy File"] -->
          | spoofs | CertificateFile["Certificate File"];

          DecoyFile["Decoy File"] -.->
            | May Deceive | T1048["Exfiltration Over Alternative Protocol"] ;
          class DecoyFile DefensiveTechniqueNode;
          class CertificateFile ArtifactNode;
          click DecoyFile href "/technique/d3f:DecoyFile";              RemoteTerminalSessionDetection["Remote Terminal Session Detection"] -->
          | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"];

          
          class RemoteTerminalSessionDetection DefensiveTechniqueNode;
          class OutboundInternetNetworkTraffic ArtifactNode;
          click RemoteTerminalSessionDetection href "/technique/d3f:RemoteTerminalSessionDetection";  CertificateAnalysis["Certificate Analysis"] -->
          | analyzes | CertificateFile["Certificate File"];

          CertificateAnalysis["Certificate Analysis"] -.->
            | May Detect | T1048["Exfiltration Over Alternative Protocol"] ;
          class CertificateAnalysis DefensiveTechniqueNode;
          class CertificateFile ArtifactNode;
          click CertificateAnalysis href "/technique/d3f:CertificateAnalysis";         Client-serverPayloadProfiling["Client-server Payload Profiling"] -->
          | analyzes | InternetNetworkTraffic["Internet Network Traffic"];

          Client-serverPayloadProfiling["Client-server Payload Profiling"] -.->
            | May Detect | T1048["Exfiltration Over Alternative Protocol"] ;
          class Client-serverPayloadProfiling DefensiveTechniqueNode;
          class InternetNetworkTraffic ArtifactNode;
          click Client-serverPayloadProfiling href "/technique/d3f:Client-serverPayloadProfiling";                                               ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] -->
          | analyzes | OutboundInternetEncryptedTraffic["Outbound Internet Encrypted Traffic"];

          
          class ProtocolMetadataAnomalyDetection DefensiveTechniqueNode;
          class OutboundInternetEncryptedTraffic ArtifactNode;
          click ProtocolMetadataAnomalyDetection href "/technique/d3f:ProtocolMetadataAnomalyDetection";                      RelayPatternAnalysis["Relay Pattern Analysis"] -->
          | analyzes | OutboundInternetEncryptedTraffic["Outbound Internet Encrypted Traffic"];

          RelayPatternAnalysis["Relay Pattern Analysis"] -.->
            | May Detect | T1048["Exfiltration Over Alternative Protocol"] ;
          class RelayPatternAnalysis DefensiveTechniqueNode;
          class OutboundInternetEncryptedTraffic ArtifactNode;
          click RelayPatternAnalysis href "/technique/d3f:RelayPatternAnalysis"; RelayPatternAnalysis["Relay Pattern Analysis"] -->
          | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"];

          
          class RelayPatternAnalysis DefensiveTechniqueNode;
          class OutboundInternetNetworkTraffic ArtifactNode;
          click RelayPatternAnalysis href "/technique/d3f:RelayPatternAnalysis";                           Client-serverPayloadProfiling["Client-server Payload Profiling"] -->
          | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"];

          
          class Client-serverPayloadProfiling DefensiveTechniqueNode;
          class OutboundInternetNetworkTraffic ArtifactNode;
          click Client-serverPayloadProfiling href "/technique/d3f:Client-serverPayloadProfiling"; Client-serverPayloadProfiling["Client-server Payload Profiling"] -->
          | analyzes | OutboundInternetEncryptedTraffic["Outbound Internet Encrypted Traffic"];

          
          class Client-serverPayloadProfiling DefensiveTechniqueNode;
          class OutboundInternetEncryptedTraffic ArtifactNode;
          click Client-serverPayloadProfiling href "/technique/d3f:Client-serverPayloadProfiling";                                        UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] -->
          | analyzes | InternetNetworkTraffic["Internet Network Traffic"];

          UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] -.->
            | May Detect | T1048["Exfiltration Over Alternative Protocol"] ;
          class UserGeolocationLogonPatternAnalysis DefensiveTechniqueNode;
          class InternetNetworkTraffic ArtifactNode;
          click UserGeolocationLogonPatternAnalysis href "/technique/d3f:UserGeolocationLogonPatternAnalysis"; UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] -->
          | analyzes | OutboundInternetEncryptedTraffic["Outbound Internet Encrypted Traffic"];

          
          class UserGeolocationLogonPatternAnalysis DefensiveTechniqueNode;
          class OutboundInternetEncryptedTraffic ArtifactNode;
          click UserGeolocationLogonPatternAnalysis href "/technique/d3f:UserGeolocationLogonPatternAnalysis";         UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] -->
          | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"];

          
          class UserGeolocationLogonPatternAnalysis DefensiveTechniqueNode;
          class OutboundInternetNetworkTraffic ArtifactNode;
          click UserGeolocationLogonPatternAnalysis href "/technique/d3f:UserGeolocationLogonPatternAnalysis";                                FileIntegrityMonitoring["File Integrity Monitoring"] -->
          | analyzes | CertificateFile["Certificate File"];

          FileIntegrityMonitoring["File Integrity Monitoring"] -.->
            | May Detect | T1048["Exfiltration Over Alternative Protocol"] ;
          class FileIntegrityMonitoring DefensiveTechniqueNode;
          class CertificateFile ArtifactNode;
          click FileIntegrityMonitoring href "/technique/d3f:FileIntegrityMonitoring";              NetworkTrafficFiltering["Network Traffic Filtering"] -->
          | filters | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"];

          NetworkTrafficFiltering["Network Traffic Filtering"] -.->
            | May Isolate | T1048["Exfiltration Over Alternative Protocol"] ;
          class NetworkTrafficFiltering DefensiveTechniqueNode;
          class OutboundInternetNetworkTraffic ArtifactNode;
          click NetworkTrafficFiltering href "/technique/d3f:NetworkTrafficFiltering"; NetworkTrafficFiltering["Network Traffic Filtering"] -->
          | filters | InternetNetworkTraffic["Internet Network Traffic"];

          
          class NetworkTrafficFiltering DefensiveTechniqueNode;
          class InternetNetworkTraffic ArtifactNode;
          click NetworkTrafficFiltering href "/technique/d3f:NetworkTrafficFiltering"; NetworkTrafficFiltering["Network Traffic Filtering"] -->
          | filters | OutboundInternetEncryptedTraffic["Outbound Internet Encrypted Traffic"];

          
          class NetworkTrafficFiltering DefensiveTechniqueNode;
          class OutboundInternetEncryptedTraffic ArtifactNode;
          click NetworkTrafficFiltering href "/technique/d3f:NetworkTrafficFiltering";                                        FileEviction["File Eviction"] -->
          | deletes | CertificateFile["Certificate File"];

          FileEviction["File Eviction"] -.->
            | May Evict | T1048["Exfiltration Over Alternative Protocol"] ;
          class FileEviction DefensiveTechniqueNode;
          class CertificateFile ArtifactNode;
          click FileEviction href "/technique/d3f:FileEviction";              LocalFilePermissions["Local File Permissions"] -->
          | restricts | CertificateFile["Certificate File"];

          LocalFilePermissions["Local File Permissions"] -.->
            | May Harden | T1048["Exfiltration Over Alternative Protocol"] ;
          class LocalFilePermissions DefensiveTechniqueNode;
          class CertificateFile ArtifactNode;
          click LocalFilePermissions href "/technique/d3f:LocalFilePermissions"; RestoreFile["Restore File"] -->
          | restores | CertificateFile["Certificate File"];

          RestoreFile["Restore File"] -.->
            | May Restore | T1048["Exfiltration Over Alternative Protocol"] ;
          class RestoreFile DefensiveTechniqueNode;
          class CertificateFile ArtifactNode;
          click RestoreFile href "/technique/d3f:RestoreFile";                       FileEncryption["File Encryption"] -->
          | encrypts | CertificateFile["Certificate File"];

          FileEncryption["File Encryption"] -.->
            | May Harden | T1048["Exfiltration Over Alternative Protocol"] ;
          class FileEncryption DefensiveTechniqueNode;
          class CertificateFile ArtifactNode;
          click FileEncryption href "/technique/d3f:FileEncryption";                  FileAnalysis["File Analysis"] -->
          | analyzes | CertificateFile["Certificate File"];

          FileAnalysis["File Analysis"] -.->
            | May Detect | T1048["Exfiltration Over Alternative Protocol"] ;
          class FileAnalysis DefensiveTechniqueNode;
          class CertificateFile ArtifactNode;
          click FileAnalysis href "/technique/d3f:FileAnalysis";              OutboundTrafficFiltering["Outbound Traffic Filtering"] -->
          | filters | OutboundInternetEncryptedTraffic["Outbound Internet Encrypted Traffic"];

          OutboundTrafficFiltering["Outbound Traffic Filtering"] -.->
            | May Isolate | T1048["Exfiltration Over Alternative Protocol"] ;
          class OutboundTrafficFiltering DefensiveTechniqueNode;
          class OutboundInternetEncryptedTraffic ArtifactNode;
          click OutboundTrafficFiltering href "/technique/d3f:OutboundTrafficFiltering"; OutboundTrafficFiltering["Outbound Traffic Filtering"] -->
          | filters | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"];

          
          class OutboundTrafficFiltering DefensiveTechniqueNode;
          class OutboundInternetNetworkTraffic ArtifactNode;
          click OutboundTrafficFiltering href "/technique/d3f:OutboundTrafficFiltering";
json