T1048.003 Elastic Security · Elastic

Detect Exfiltration Over Unencrypted Non-C2 Protocol in Elastic Security

Adversaries may steal data by exfiltrating it over an unencrypted network protocol other than that of the existing command and control channel. Common protocols used include HTTP, FTP, SMTP, DNS, and TFTP. Data may be obfuscated using encoding schemes such as Base64 or embedded within protocol headers and fields without the use of encryption. Real-world threat actors including Lazarus Group, FIN8, APT32, Salt Typhoon, and Mustang Panda have leveraged FTP, HTTP POST, DNS tunneling, and SMTP for this purpose.

MITRE ATT&CK

Tactic
Exfiltration
Technique
T1048 Exfiltration Over Alternative Protocol
Sub-technique
T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
Canonical reference
https://attack.mitre.org/techniques/T1048/003/

Elastic Detection Query

Elastic Security (Elastic)
eql 
any where
  (event.category == "process" and event.type == "start" and (
    process.name in~ ("ftp.exe", "winscp.exe", "filezilla.exe", "ncftp", "lftp", "dnscat", "iodine", "dns2tcp", "blat.exe", "swaks", "sendmail", "msmtp") or
    (
      process.name in~ ("curl.exe", "curl", "wget.exe", "wget") and
      process.command_line like~ "*http://*" and
      (
        process.args : ("--upload-file", "--data-binary", "--form", "-F") or
        process.command_line like~ "*--data @*" or
        process.command_line like~ "*-d @*"
      )
    ) or
    process.command_line like~ "*ftp://*" or
    process.command_line like~ "*ftps://*" or
    process.args : ("--ftp-upload", "STOR") or
    process.command_line like~ "*dnscat*" or
    process.command_line like~ "*iodine*" or
    process.command_line like~ "*dns2tcp*" or
    (
      process.command_line like~ "*smtp*" and
      (
        process.args : ("-attach", "--attach", "-server") or
        process.command_line like~ "*-to *" or
        process.command_line like~ "*--to *"
      )
    )
  )) or
  (event.category == "network" and event.type in ("connection", "start") and
   destination.port in (21, 25, 69, 80, 110, 143, 2121, 8080, 8000, 8888) and
   not destination.ip like ("10.*", "172.16.*", "172.17.*", "172.18.*", "172.19.*",
     "172.20.*", "172.21.*", "172.22.*", "172.23.*", "172.24.*", "172.25.*",
     "172.26.*", "172.27.*", "172.28.*", "172.29.*", "172.30.*", "172.31.*",
     "192.168.*", "127.*", "::1") and
   not process.name in~ ("chrome.exe", "firefox.exe", "msedge.exe", "iexplore.exe",
     "svchost.exe", "services.exe", "lsass.exe", "MsMpEng.exe")
  )
high severity medium confidence

Detects exfiltration over unencrypted non-C2 protocols via two correlated event categories: (1) process launches matching known FTP clients, curl/wget HTTP upload patterns targeting plaintext HTTP URLs, DNS tunneling tools (dnscat, iodine, dns2tcp), and SMTP exfiltration utilities (blat, swaks, sendmail); (2) outbound network connections on plaintext protocol ports (FTP/21, SMTP/25, TFTP/69, HTTP/80, POP3/110, IMAP/143, HTTP-alt/8080/8000/8888) to external IPs from non-browser processes.

Data Sources

Elastic Endpoint Security (EDR)Winlogbeat with SysmonPacketbeat network capture

Required Tables

logs-endpoint.events.process-*logs-endpoint.events.network-*logs-windows.sysmon_operational-*

False Positives & Tuning

  • Legitimate FTP or plain HTTP file transfers by system administrators performing patching, configuration pushes, or authorized data migrations to external hosting providers
  • Internal developer tooling or CI/CD pipelines that upload build artifacts over plain HTTP to internal artifact repositories that route through addresses appearing external
  • Network diagnostic engineers running nslookup, dig, or DNS resolution scripts as part of authorized troubleshooting that match DNS tunneling command-line patterns
Download portable Sigma rule (.yml)

Other platforms for T1048.003

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1FTP File Exfiltration Using Native Windows FTP Client

    Expected signal: Sysmon Event ID 1: Process Create with Image=ftp.exe, CommandLine containing '-s:%TEMP%\ftp_script.txt'. Sysmon Event ID 11: File Create for ftp_script.txt. Sysmon Event ID 3: Network Connection attempt to 127.0.0.1:21 (may not appear if connection immediately refused). Security Event ID 4688 if command line auditing enabled.

  2. Test 2HTTP POST File Upload via curl to Plaintext Endpoint

    Expected signal: Sysmon Event ID 1: Process Create with Image=curl.exe, CommandLine containing '--upload-file' and 'http://127.0.0.1:8080/upload'. Sysmon Event ID 3: Network Connection to 127.0.0.1:8080 from curl.exe. The connection will be refused but process and network events will still be logged.

  3. Test 3DNS Subdomain Exfiltration via nslookup

    Expected signal: Sysmon Event ID 1: Process Create for powershell.exe and child nslookup.exe with a long base64-like subdomain in the command line. Sysmon Event ID 22: DNS query event showing the long subdomain query. The query will fail (NXDOMAIN or timeout) but all telemetry is generated.

  4. Test 4SMTP Email Exfiltration via PowerShell Send-MailMessage

    Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Send-MailMessage', '-SmtpServer', and '-Attachments'. Sysmon Event ID 3: Network Connection attempt to 127.0.0.1:25. PowerShell ScriptBlock Log Event ID 4104 with the full Send-MailMessage command and parameters including attachment path.

  5. Test 5Data Staging and FTP Exfiltration via WinSCP Script (Linux/macOS via curl)

    Expected signal: Linux auditd or Sysmon for Linux Event ID 1: Process Create for tar, then curl with --upload-file and ftp:// URL. Syslog or auditd SYSCALL records for execve of curl with FTP arguments. Network connection attempt to 127.0.0.1:21. File creation events for the tar archive.

Last updated: 2026-04-16 Research depth: deep
References (12)

Unlock Pro Content

Get the full detection package for T1048.003 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Parent Technique

T1048Exfiltration Over Alternative Protocol

Related Sub-techniques

T1048.001Exfiltration Over Symmetric Encrypted Non-C2 ProtocolT1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Related Techniques

T1048Exfiltration Over Alternative ProtocolT1048.001Exfiltration Over Symmetric Encrypted Non-C2 ProtocolT1048.002Exfiltration Over Asymmetric Encrypted Non-C2 ProtocolT1041Exfiltration Over C2 ChannelT1071.001Web ProtocolsT1071.002File Transfer ProtocolsT1071.004DNST1560Archive Collected DataT1005Data from Local SystemT1074Data StagedT1567Exfiltration Over Web ServiceT1020Automated Exfiltration

Same Tactic: Exfiltration

Popular Detections