Exfiltration Over C2 Channel (T1041)

Tactic: Exfiltration · Platforms: ESXi, Linux, macOS, Windows

The interactive view maps 1 detection strategy, 2 mitigations, 27 threat groups, 164 software entries, 10 campaigns to this technique, alongside D3FEND countermeasures and data-component coverage.

Overview

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.

Explore

• Open T1041 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1041
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan