T1048.003 — Exfiltration Over Unencrypted Non-C2 Protocol

Tactic: Exfiltration · Platforms: ESXi, Linux, macOS, Network Devices, Windows

Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Adversaries may opt to obfuscate this data, without…

Sub-technique of Exfiltration Over Alternative Protocol (T1048).

Sigma detection rules (5)

title: "T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
id: bd96a588-2175-4727-9e1d-b9b3ae5bf807
description: 'Detects exfiltration over an unencrypted non-C2 protocol via Sysmon network connections to common cleartext-protocol ports (FTP 21, Telnet 23, SMTP 25, HTTP 80) from processes that are not standard web browsers. Corrected from a service:security definition using Sysmon-only EventIDs 3/22, a non-existent event/log pairing. Data Component: Network Connection Creation. Tune using: UnencryptedProtocolList, DataTransferSizeThreshold, ParentProcessDenylist.'
references:
  - https://attack.mitre.org/techniques/T1048/003
author: Shahrukh Khan
date: 2026-04-29
license: MIT
tags:
  - attack.exfiltration
  - attack.t1048.003

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 3
    DestinationPort:
      - 21
      - 23
      - 25
      - 80
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
      - '\iexplore.exe'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection and not 1 of filter_*

falsepositives:
  - Legacy line-of-business applications still using FTP, Telnet, or unauthenticated SMTP relays.
  - Internal mail relay or FTP backup jobs running under service accounts not covered by filter_system_account.

level: medium

title: "T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
id: bfa8f6e6-d44c-4909-a6a9-c96b8b9f0a8a
description: 'Detection of Exfiltration Over Unencrypted Non-C2 Protocol. Previously matched curl/wget/ftp with a bare http:// argument, which fires on ordinary downloads just as much as exfiltration since it never checked for any outbound-data-transfer flag. Now requires an exfil-indicative flag (curl -d/--data/-F/--upload-file/-T, or wget --post-data/--post-file) alongside the http:// reference, confirming data is actually being sent rather than merely fetched. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: SensitiveDirectoryWatchlist, ProcessBaseline, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1048/003
author: Shahrukh Khan
date: 2026-05-01
license: MIT
tags:
  - attack.exfiltration
  - attack.t1048.003

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/curl'
      - '/wget'
      - '/ftp'
    a1|contains: 'http://'
  selection_upload_flag:
    - a1|contains:
        - '-d'
        - '--data'
        - '-F'
        - '--upload-file'
        - '-T'
        - '--post-data'
        - '--post-file'
    - a2|contains:
        - '-d'
        - '--data'
        - '-F'
        - '--upload-file'
        - '-T'
        - '--post-data'
        - '--post-file'
    - a3|contains:
        - '-d'
        - '--data'
        - '-F'
        - '--upload-file'
        - '-T'
        - '--post-data'
        - '--post-file'

  condition: selection and selection_upload_flag

falsepositives:
  - Legitimate use of unencrypted HTTP for internal, non-sensitive endpoints or legacy systems where TLS isn't deployed, when combined with a genuine upload flag (e.g. API integrations posting data to an internal HTTP-only service).

level: medium

title: "T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
id: f0e2eaf8-40f9-4935-b617-121d550dcef5
description: 'Detection of Exfiltration Over Unencrypted Non-C2 Protocol. (Retargeted to the network_connection macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ScriptedClientAllowlist, PayloadInspectionKeywordList.'
references:
  - https://attack.mitre.org/techniques/T1048/003
author: Shahrukh Khan
date: 2026-01-31
license: MIT
tags:
  - attack.exfiltration
  - attack.t1048.003

logsource:
  category: network_connection
  product: macos

detection:
  selection:
    Image|endswith:
      - '/curl'
      - '/python3'
      - '/nc'
  selection_port:
    DestinationPort:
      - 21
      - 25
      - 80
  condition: selection and selection_port

falsepositives:
  - Legitimate scripted clients transferring files or mail over unencrypted protocols in test or legacy environments, since payload inspection keyword matching is not possible on unified log connection metadata.

level: medium

title: "T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
id: d65ff86a-5bdf-458d-a428-5bf956eebf33
description: 'Detection of Exfiltration Over Unencrypted Non-C2 Protocol. (Data Component: Command Execution; baseline tier: fallback.) Tune using: ProtocolCommandWatchlist, DestinationIPBlocklist.'
references:
  - https://attack.mitre.org/techniques/T1048/003
author: Shahrukh Khan
date: 2026-03-02
license: MIT
tags:
  - attack.exfiltration
  - attack.t1048.003

logsource:
  category: process_creation
  product: networkdevice
  service: cli

detection:
  selection_transfer:
    CommandLine|contains:
      - 'copy running-config tftp'
      - 'copy startup-config ftp'
      - 'copy flash: tftp'
      - 'request system snapshot'
  selection_dns_alt:
    CommandLine|contains: 'nslookup'
  condition: selection_transfer or selection_dns_alt

falsepositives:
  - Legitimate configuration backup jobs pushing device config to an approved TFTP or FTP backup server.

level: high

title: "T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol"
id: e556401a-f283-478f-b8f0-062f6c06927f
description: 'Detection of Exfiltration Over Unencrypted Non-C2 Protocol. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: VMConfigAccessPathWatchlist, OutboundProtocolProfile.'
references:
  - https://attack.mitre.org/techniques/T1048/003
author: Shahrukh Khan
date: 2026-05-17
license: MIT
tags:
  - attack.exfiltration
  - attack.t1048.003

logsource:
  category: process_creation
  product: esxi
  service: shell

detection:
  selection:
    CommandLine|contains:
      - 'tftp '
      - 'ftp '
      - 'nc -w'
  selection_path:
    CommandLine|contains: '/vmfs/volumes/'

  condition: selection and selection_path

falsepositives:
  - Legacy firmware or ISO transfer workflows still occasionally use FTP or TFTP for legitimate datastore file movement.

level: medium

Related sub-techniques

• T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
• T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1048.003 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan