T1041 — Exfiltration Over C2 Channel

Tactic: Exfiltration · Platforms: ESXi, Linux, macOS, Windows

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.

Sigma detection rules (4)

T1041 Exfiltration Over C2 Channel

title: T1041 Exfiltration Over C2 Channel
id: a77a7e89-c6cd-4189-a93e-0c1947c1034e
description: 'Detects outbound connections initiated by LOLBins (rundll32/regsvr32/mshta/certutil) commonly abused as C2 implants. (Data Component: Network Connection Creation; baseline tier: windows-eventid.) Tune using: DataVolumeThreshold, KnownBenignProcesses.'
references:
  - https://attack.mitre.org/techniques/T1041
author: Shahrukh Khan
date: 2026-04-04
license: MIT
tags:
  - attack.exfiltration
  - attack.t1041

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection_lolbin_network:
    Image|endswith:
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\mshta.exe'
      - '\certutil.exe'
    Initiated: 'true'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection_lolbin_network and not filter_system_account

falsepositives:
  - regsvr32/certutil legitimate outbound connections.

level: medium

T1041 Exfiltration Over C2 Channel

title: T1041 Exfiltration Over C2 Channel
id: d342e7cb-9057-4b2a-a07a-f3ff87e2e1b7
description: 'T1041 Exfiltration Over C2 Channel: auditd cannot determine whether a given connection is reusing an already-established C2 session versus a fresh one-off connection, since that requires cross-event/session correlation outside a single event''s fields; retargeted to the strongest Linux-observable proxy -- interactive reverse-shell primitives (bash /dev/tcp pseudo-device redirects, or nc -e) that function as combined command-and-control-plus-data channels on Linux, where any subsequent command executed through them constitutes exfiltration over that channel. Tune using: OutboundEntropyScore, ConnectionDuration, destination allowlist.'
references:
  - https://attack.mitre.org/techniques/T1041
author: Shahrukh Khan
date: 2026-05-25
license: MIT
tags:
  - attack.exfiltration
  - attack.t1041

logsource:
  category: process_creation
  product: linux

detection:
  selection_devtcp_shell:
    type: EXECVE
    a0|endswith:
      - '/bash'
      - '/sh'
    a1: '-c'
    a2|contains: '/dev/tcp/'
  selection_nc_reverse_shell:
    type: EXECVE
    a0|endswith:
      - '/nc'
      - '/ncat'
      - '/netcat'
    a1|contains: '-e'
  condition: selection_devtcp_shell or selection_nc_reverse_shell

falsepositives:
  - Legitimate use of bash's /dev/tcp for lightweight health-check/port-probe scripts, or authorized use of nc -e in break-glass remote-support tooling; both are rare in hardened environments and warrant investigation regardless.

level: high

T1041 Exfiltration Over C2 Channel

title: T1041 Exfiltration Over C2 Channel
id: 8aa857ec-4e62-4278-8e53-2f7bce8fe143
description: 'Detection Strategy for Exfiltration Over C2 Channel. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ParentProcessAncestry, ProtocolList.'
references:
  - https://attack.mitre.org/techniques/T1041
author: Shahrukh Khan
date: 2026-05-19
license: MIT
tags:
  - attack.exfiltration
  - attack.t1041

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    ParentImage|endswith:
      - '/osascript'
      - '/python3'
  selection_tool:
    Image|endswith:
      - '/curl'
      - '/nc'
  selection_post:
    CommandLine|contains: '-X POST'
  condition: selection and selection_tool and selection_post

falsepositives:
  - Automation scripts that legitimately chain a scripting engine into a curl POST request for API integrations.

level: medium

T1041 Exfiltration Over C2 Channel

title: T1041 Exfiltration Over C2 Channel
id: f4123c5e-124d-4562-a8ad-c7f9c65e9381
description: 'Detection Strategy for Exfiltration Over C2 Channel. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: GuestOSAllowList, TransferSizeThresholdMB, ProtocolAllowList.'
references:
  - https://attack.mitre.org/techniques/T1041
author: Shahrukh Khan
date: 2026-05-17
license: MIT
tags:
  - attack.exfiltration
  - attack.t1041

logsource:
  product: esxi
  service: hostd

detection:
  selection:
    Message|contains: 'Firewall'
  selection_out:
    Message|contains|all:
      - 'ruleset'
      - 'outgoing'

  condition: selection and selection_out

falsepositives:
  - ESXi host logs cannot measure transfer size or distinguish exfiltration from legitimate outbound management traffic over the same allowed channel, so this only flags firewall ruleset changes enabling new outbound paths.

level: low

Explore