Esc
Exfiltration Over Symmetric Encrypted Non-C2 Protocol - T1048.001

(ATT&CK® Technique)
Definition

Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
D3FEND Inferred Relationships

Browse the D3FEND knowledge graph by clicking on the nodes below.
        graph LR;

     T1048001["Exfiltration Over Symmetric Encrypted Non-C2 Protocol"] --> |produces| OutboundInternetEncryptedTraffic["Outbound Internet Encrypted Traffic"]; class T1048001 OffensiveTechniqueNode;
        class OutboundInternetEncryptedTraffic ArtifactNode; click OutboundInternetEncryptedTraffic href "/dao/artifact/d3f:OutboundInternetEncryptedTraffic";
        click T1048001 href "/offensive-technique/attack/T1048.001/"; click OutboundInternetEncryptedTraffic href "/dao/artifact/d3f:OutboundInternetEncryptedTraffic";         T1048001["Exfiltration Over Symmetric Encrypted Non-C2 Protocol"] --> |produces| InternetNetworkTraffic["Internet Network Traffic"]; class T1048001 OffensiveTechniqueNode;
        class InternetNetworkTraffic ArtifactNode; click InternetNetworkTraffic href "/dao/artifact/d3f:InternetNetworkTraffic";
        click T1048001 href "/offensive-technique/attack/T1048.001/"; click InternetNetworkTraffic href "/dao/artifact/d3f:InternetNetworkTraffic";     PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] -->
          | analyzes | OutboundInternetEncryptedTraffic["Outbound Internet Encrypted Traffic"];

          PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] -.->
            | May Detect | T1048001["Exfiltration Over Symmetric Encrypted Non-C2 Protocol"] ;
          class PerHostDownload-UploadRatioAnalysis DefensiveTechniqueNode;
          class OutboundInternetEncryptedTraffic ArtifactNode;
          click PerHostDownload-UploadRatioAnalysis href "/technique/d3f:PerHostDownload-UploadRatioAnalysis"; ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] -->
          | analyzes | OutboundInternetEncryptedTraffic["Outbound Internet Encrypted Traffic"];

          ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] -.->
            | May Detect | T1048001["Exfiltration Over Symmetric Encrypted Non-C2 Protocol"] ;
          class ProtocolMetadataAnomalyDetection DefensiveTechniqueNode;
          class OutboundInternetEncryptedTraffic ArtifactNode;
          click ProtocolMetadataAnomalyDetection href "/technique/d3f:ProtocolMetadataAnomalyDetection"; RelayPatternAnalysis["Relay Pattern Analysis"] -->
          | analyzes | OutboundInternetEncryptedTraffic["Outbound Internet Encrypted Traffic"];

          RelayPatternAnalysis["Relay Pattern Analysis"] -.->
            | May Detect | T1048001["Exfiltration Over Symmetric Encrypted Non-C2 Protocol"] ;
          class RelayPatternAnalysis DefensiveTechniqueNode;
          class OutboundInternetEncryptedTraffic ArtifactNode;
          click RelayPatternAnalysis href "/technique/d3f:RelayPatternAnalysis"; RemoteTerminalSessionDetection["Remote Terminal Session Detection"] -->
          | analyzes | OutboundInternetEncryptedTraffic["Outbound Internet Encrypted Traffic"];

          RemoteTerminalSessionDetection["Remote Terminal Session Detection"] -.->
            | May Detect | T1048001["Exfiltration Over Symmetric Encrypted Non-C2 Protocol"] ;
          class RemoteTerminalSessionDetection DefensiveTechniqueNode;
          class OutboundInternetEncryptedTraffic ArtifactNode;
          click RemoteTerminalSessionDetection href "/technique/d3f:RemoteTerminalSessionDetection";                     NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] -->
          | analyzes | OutboundInternetEncryptedTraffic["Outbound Internet Encrypted Traffic"];

          NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] -.->
            | May Detect | T1048001["Exfiltration Over Symmetric Encrypted Non-C2 Protocol"] ;
          class NetworkTrafficSignatureAnalysis DefensiveTechniqueNode;
          class OutboundInternetEncryptedTraffic ArtifactNode;
          click NetworkTrafficSignatureAnalysis href "/technique/d3f:NetworkTrafficSignatureAnalysis";                PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] -->
          | analyzes | InternetNetworkTraffic["Internet Network Traffic"];

          
          class PerHostDownload-UploadRatioAnalysis DefensiveTechniqueNode;
          class InternetNetworkTraffic ArtifactNode;
          click PerHostDownload-UploadRatioAnalysis href "/technique/d3f:PerHostDownload-UploadRatioAnalysis"; ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] -->
          | analyzes | InternetNetworkTraffic["Internet Network Traffic"];

          
          class ProtocolMetadataAnomalyDetection DefensiveTechniqueNode;
          class InternetNetworkTraffic ArtifactNode;
          click ProtocolMetadataAnomalyDetection href "/technique/d3f:ProtocolMetadataAnomalyDetection";   RemoteTerminalSessionDetection["Remote Terminal Session Detection"] -->
          | analyzes | InternetNetworkTraffic["Internet Network Traffic"];

          
          class RemoteTerminalSessionDetection DefensiveTechniqueNode;
          class InternetNetworkTraffic ArtifactNode;
          click RemoteTerminalSessionDetection href "/technique/d3f:RemoteTerminalSessionDetection";                      Client-serverPayloadProfiling["Client-server Payload Profiling"] -->
          | analyzes | OutboundInternetEncryptedTraffic["Outbound Internet Encrypted Traffic"];

          Client-serverPayloadProfiling["Client-server Payload Profiling"] -.->
            | May Detect | T1048001["Exfiltration Over Symmetric Encrypted Non-C2 Protocol"] ;
          class Client-serverPayloadProfiling DefensiveTechniqueNode;
          class OutboundInternetEncryptedTraffic ArtifactNode;
          click Client-serverPayloadProfiling href "/technique/d3f:Client-serverPayloadProfiling"; NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] -->
          | analyzes | OutboundInternetEncryptedTraffic["Outbound Internet Encrypted Traffic"];

          NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] -.->
            | May Detect | T1048001["Exfiltration Over Symmetric Encrypted Non-C2 Protocol"] ;
          class NetworkTrafficCommunityDeviation DefensiveTechniqueNode;
          class OutboundInternetEncryptedTraffic ArtifactNode;
          click NetworkTrafficCommunityDeviation href "/technique/d3f:NetworkTrafficCommunityDeviation";                       Client-serverPayloadProfiling["Client-server Payload Profiling"] -->
          | analyzes | InternetNetworkTraffic["Internet Network Traffic"];

          
          class Client-serverPayloadProfiling DefensiveTechniqueNode;
          class InternetNetworkTraffic ArtifactNode;
          click Client-serverPayloadProfiling href "/technique/d3f:Client-serverPayloadProfiling";  NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] -->
          | analyzes | InternetNetworkTraffic["Internet Network Traffic"];

          
          class NetworkTrafficCommunityDeviation DefensiveTechniqueNode;
          class InternetNetworkTraffic ArtifactNode;
          click NetworkTrafficCommunityDeviation href "/technique/d3f:NetworkTrafficCommunityDeviation";   NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] -->
          | analyzes | InternetNetworkTraffic["Internet Network Traffic"];

          
          class NetworkTrafficSignatureAnalysis DefensiveTechniqueNode;
          class InternetNetworkTraffic ArtifactNode;
          click NetworkTrafficSignatureAnalysis href "/technique/d3f:NetworkTrafficSignatureAnalysis";         UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] -->
          | analyzes | OutboundInternetEncryptedTraffic["Outbound Internet Encrypted Traffic"];

          UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] -.->
            | May Detect | T1048001["Exfiltration Over Symmetric Encrypted Non-C2 Protocol"] ;
          class UserGeolocationLogonPatternAnalysis DefensiveTechniqueNode;
          class OutboundInternetEncryptedTraffic ArtifactNode;
          click UserGeolocationLogonPatternAnalysis href "/technique/d3f:UserGeolocationLogonPatternAnalysis"; NetworkTrafficFiltering["Network Traffic Filtering"] -->
          | filters | OutboundInternetEncryptedTraffic["Outbound Internet Encrypted Traffic"];

          NetworkTrafficFiltering["Network Traffic Filtering"] -.->
            | May Isolate | T1048001["Exfiltration Over Symmetric Encrypted Non-C2 Protocol"] ;
          class NetworkTrafficFiltering DefensiveTechniqueNode;
          class OutboundInternetEncryptedTraffic ArtifactNode;
          click NetworkTrafficFiltering href "/technique/d3f:NetworkTrafficFiltering";                 UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] -->
          | analyzes | InternetNetworkTraffic["Internet Network Traffic"];

          
          class UserGeolocationLogonPatternAnalysis DefensiveTechniqueNode;
          class InternetNetworkTraffic ArtifactNode;
          click UserGeolocationLogonPatternAnalysis href "/technique/d3f:UserGeolocationLogonPatternAnalysis";  NetworkTrafficFiltering["Network Traffic Filtering"] -->
          | filters | InternetNetworkTraffic["Internet Network Traffic"];

          
          class NetworkTrafficFiltering DefensiveTechniqueNode;
          class InternetNetworkTraffic ArtifactNode;
          click NetworkTrafficFiltering href "/technique/d3f:NetworkTrafficFiltering";          OutboundTrafficFiltering["Outbound Traffic Filtering"] -->
          | filters | OutboundInternetEncryptedTraffic["Outbound Internet Encrypted Traffic"];

          OutboundTrafficFiltering["Outbound Traffic Filtering"] -.->
            | May Isolate | T1048001["Exfiltration Over Symmetric Encrypted Non-C2 Protocol"] ;
          class OutboundTrafficFiltering DefensiveTechniqueNode;
          class OutboundInternetEncryptedTraffic ArtifactNode;
          click OutboundTrafficFiltering href "/technique/d3f:OutboundTrafficFiltering";
json