T1048.001 — Exfiltration Over Symmetric Encrypted Non-C2 Protocol

Tactic: Exfiltration · Platforms: Linux, macOS, Windows, ESXi

Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Symmetric encryption algorithms are those…

Sub-technique of Exfiltration Over Alternative Protocol (T1048).

Sigma detection rules (4)

title: "T1048.001 Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
id: 5a41e3be-bdad-4b63-b60e-fdb697443f0f
description: 'Detects script-interpreter processes making outbound network connections on ports other than standard web ports, a conservative Windows-observable proxy for data sent over a custom/non-C2 encrypted channel — Sysmon network telemetry cannot determine whether a connection actually uses symmetric encryption, so this flags the process+port pattern instead of the cipher itself. Tune using: PayloadEntropyThreshold, TimeWindow, ExecutableAllowlist.'
references:
  - https://attack.mitre.org/techniques/T1048/001
author: Shahrukh Khan
date: 2026-03-18
license: MIT
tags:
  - attack.exfiltration
  - attack.t1048.001

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '3'
    Initiated: 'true'
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'

  filter_common_ports:
    DestinationPort:
      - 80
      - 443
      - 8080
      - 8443

  condition: selection and not filter_common_ports

falsepositives:
  - Legitimate script-driven tooling (update agents, custom monitoring) that connects out on non-standard ports; this rule is a coarse proxy for 'exfiltration hidden in an unusual protocol/port' and should be tuned to your environment's actual expected non-web traffic.

level: medium

title: "T1048.001 Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
id: d6faba74-a703-43c4-806f-9774edd5de91
description: 'Behavioral Detection Strategy for Exfiltration Over Symmetric Encrypted Non-C2 Protocol. Bare openssl s_client invocation is a weak standalone signal since auditd argv cannot show what is piped into its stdin; this rule is now paired with a companion correlation rule (below) that requires a data-staging command (tar/dd/openssl enc) to execute in the same audit session shortly before s_client, approximating the parent-process/pipe relationship auditd cannot directly capture. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: FileTransferIndicator, LibraryCallTracking, CorrelationWindow.'
references:
  - https://attack.mitre.org/techniques/T1048/001
author: Shahrukh Khan
date: 2026-04-26
license: MIT
tags:
  - attack.exfiltration
  - attack.t1048.001

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith: '/openssl'
    a1: 's_client'
  condition: selection

falsepositives:
  - openssl s_client is a standard tool for legitimate TLS debugging/testing by administrators; standalone this remains a weak indicator. See the companion correlation rule below for a higher-fidelity variant that also requires a preceding data-staging command in the same session.

level: medium
---
title: "T1048.001 Data Staging Command Preceding TLS Session (tar/dd/openssl enc)"
id: 2b6f0e3a-7c1d-4e5a-9b8f-3d6a1c7e4f52
description: 'Companion detection for T1048.001: flags execution of common data-staging/encoding commands (tar, dd, openssl enc) that are frequently piped into openssl s_client to exfiltrate data over a symmetric-encrypted non-C2 channel. Not intended for standalone alerting; used as one half of the correlation rule below alongside d6faba74-a703-43c4-806f-9774edd5de91.'
references:
  - https://attack.mitre.org/techniques/T1048/001
author: Shahrukh Khan
date: 2026-07-26
license: MIT
tags:
  - attack.exfiltration
  - attack.t1048.001

logsource:
  category: process_creation
  product: linux

detection:
  selection_tar:
    type: EXECVE
    a0|endswith: '/tar'
  selection_dd:
    type: EXECVE
    a0|endswith: '/dd'
  selection_openssl_enc:
    type: EXECVE
    a0|endswith: '/openssl'
    a1: 'enc'
  condition: 1 of selection_*

falsepositives:
  - tar, dd, and openssl enc are ubiquitous administrative and backup tools; this rule is intentionally low-confidence and is meant only as one half of the correlation companion below, not for standalone alerting.

level: informational
---
title: 'T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol - Staging Command Followed by openssl s_client'
id: 8f4d3c2b-1a9e-4d6f-8b7c-5e2a9f0d3c61
description: 'Correlation companion for d6faba74-a703-43c4-806f-9774edd5de91: requires a data-staging command (tar/dd/openssl enc, rule 2b6f0e3a-7c1d-4e5a-9b8f-3d6a1c7e4f52) and an openssl s_client invocation to both occur within the same audit session within a 5-minute window, approximating the pipe/parent-process relationship (for example tar czf - /data piped into openssl s_client -connect ...) that auditd argv alone cannot show.'
status: experimental
correlation:
  type: temporal
  rules:
    - 2b6f0e3a-7c1d-4e5a-9b8f-3d6a1c7e4f52
    - d6faba74-a703-43c4-806f-9774edd5de91
  group-by:
    - ses
  timespan: 5m
level: high

title: "T1048.001 Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
id: da312253-eba3-49f1-8b77-b073fc79b241
description: 'Behavioral Detection Strategy for Exfiltration Over Symmetric Encrypted Non-C2 Protocol. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ApplicationProfileBaseline, EncryptionRoutinePattern.'
references:
  - https://attack.mitre.org/techniques/T1048/001
author: Shahrukh Khan
date: 2026-02-28
license: MIT
tags:
  - attack.exfiltration
  - attack.t1048.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/openssl'
    CommandLine|contains: 's_client'
  condition: selection

falsepositives:
  - Administrators or developers legitimately testing TLS connectivity with openssl s_client, since application-profile baselining of expected TLS clients is not derivable from process_creation alone.

level: medium

title: "T1048.001 Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
id: c49da8d7-14be-463e-86f2-078cac5e0f9b
description: 'Behavioral Detection Strategy for Exfiltration Over Symmetric Encrypted Non-C2 Protocol. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: GuestVMExfilWatchlist, ServiceEgressProfile.'
references:
  - https://attack.mitre.org/techniques/T1048/001
author: Shahrukh Khan
date: 2026-01-21
license: MIT
tags:
  - attack.exfiltration
  - attack.t1048.001

logsource:
  product: esxi
  service: vmkernel

detection:
  selection:
    Message|contains: 'VMFS'
  selection_write:
    Message|contains:
      - 'write'
      - 'datastore'

  condition: selection and selection_write

falsepositives:
  - This is a weak proxy since vmkernel storage I/O logging cannot distinguish an encrypted exfiltration channel from ordinary VM disk activity; treat only as a low-confidence supporting signal.

level: low

Related sub-techniques

• T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
• T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1048.001 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan