T1048.002 — Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Tactic: Exfiltration · Platforms: ESXi, Linux, macOS, Windows

Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Asymmetric encryption algorithms are…

Sub-technique of Exfiltration Over Alternative Protocol (T1048).

Sigma detection rules (4)

T1048.002 Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

title: "T1048.002 Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
id: c99fe6f1-2716-4495-bb0d-6c230d30aade
description: 'Detects outbound connections to ports for asymmetric-encrypted protocols (HTTPS/TLS, FTPS, IMAPS, POP3S). (Data Component: Network Connection Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, CertificateIssuerDenylist, BinaryAllowlist.'
references:
  - https://attack.mitre.org/techniques/T1048/002
author: Shahrukh Khan
date: 2026-03-31
license: MIT
tags:
  - attack.exfiltration
  - attack.t1048.002

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '3'
    Initiated: 'true'
    DestinationPort:
      - 443
      - 465
      - 989
      - 990
      - 993
      - 995
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  filter_common_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\iexplore.exe'
  condition: selection and not 1 of filter_*

falsepositives:
  - Legitimate TLS/FTPS/IMAPS/POP3S traffic.

level: medium

T1048.002 Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

title: "T1048.002 Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
id: ff073eaa-98fb-427c-a749-2b7f01a99ad5
description: 'Detection of Exfiltration Over Asymmetric Encrypted Non-C2 Protocol. Previously any curl/scp invocation alone satisfied the rule (condition was "1 of selection_*"), firing on ordinary file transfers with no relation to encryption. A separate gpg process and a separate curl/scp process cannot be correlated within a single auditd EXECVE event, so requiring both selectors as independent alternatives was also unsound. Retargeted so the SAME curl/scp invocation must itself reference a file with an asymmetric-encryption-associated extension (.gpg/.pgp/.asc/.p7m/.enc) somewhere in its own argv -- a signal observable within one auditd EXECVE record. Tune using: ConnectionDestinationScope, FileAccessExtensionList, SSLClientProcessBaseline.'
references:
  - https://attack.mitre.org/techniques/T1048/002
author: Shahrukh Khan
date: 2026-06-19
license: MIT
tags:
  - attack.exfiltration
  - attack.t1048.002

logsource:
  category: process_creation
  product: linux

detection:
  selection_transfer:
    type: EXECVE
    a0|endswith:
      - '/curl'
      - '/scp'
  selection_encrypted_arg1:
    type: EXECVE
    a1|endswith:
      - '.gpg'
      - '.pgp'
      - '.asc'
      - '.p7m'
      - '.enc'
  selection_encrypted_arg2:
    type: EXECVE
    a2|endswith:
      - '.gpg'
      - '.pgp'
      - '.asc'
      - '.p7m'
      - '.enc'
  selection_encrypted_arg3:
    type: EXECVE
    a3|endswith:
      - '.gpg'
      - '.pgp'
      - '.asc'
      - '.p7m'
      - '.enc'

  condition: selection_transfer and 1 of selection_encrypted_arg*

falsepositives:
  - Legitimate transfer of already-encrypted backups, GPG-signed release artifacts, or PKI-managed files (.p7m, .asc) via curl/scp for authorized data sharing.

level: medium

T1048.002 Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

title: "T1048.002 Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
id: ac79ef18-edf6-43b5-9654-05105b4ac24b
description: 'Detection of Exfiltration Over Asymmetric Encrypted Non-C2 Protocol. (Retargeted to the network_connection macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: OutboundTrafficVolumeThreshold, FileSensitivityContext.'
references:
  - https://attack.mitre.org/techniques/T1048/002
author: Shahrukh Khan
date: 2026-03-16
license: MIT
tags:
  - attack.exfiltration
  - attack.t1048.002

logsource:
  category: network_connection
  product: macos

detection:
  selection:
    DestinationPort: 443
  selection_process:
    Image|endswith:
      - '/curl'
      - '/python3'
  filter_browser:
    Image|endswith:
      - '/Safari'
      - '/Google Chrome'
  condition: selection and selection_process and not filter_browser

falsepositives:
  - Non-browser tools that legitimately use HTTPS for API calls, since transfer volume thresholds cannot be computed from a single connection event.

level: medium

T1048.002 Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

title: "T1048.002 Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
id: df459d41-7be4-44c3-9244-389bcedd7f52
description: 'Detection of Exfiltration Over Asymmetric Encrypted Non-C2 Protocol. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: VMToEgressPathWatchlist, TLSClientAppIdentifier.'
references:
  - https://attack.mitre.org/techniques/T1048/002
author: Shahrukh Khan
date: 2026-03-19
license: MIT
tags:
  - attack.exfiltration
  - attack.t1048.002

logsource:
  category: process_creation
  product: esxi
  service: shell

detection:
  selection:
    CommandLine|contains:
      - 'scp -i'
      - 'sftp '
      - 'openssl s_client'

  condition: selection

falsepositives:
  - Administrators using key-based scp or sftp for legitimate backup or firmware update transfers will also match.

level: medium

Related sub-techniques

Explore