T1048.003 Microsoft Sentinel · KQL

Detect Exfiltration Over Unencrypted Non-C2 Protocol in Microsoft Sentinel

Adversaries may steal data by exfiltrating it over an unencrypted network protocol other than that of the existing command and control channel. Common protocols used include HTTP, FTP, SMTP, DNS, and TFTP. Data may be obfuscated using encoding schemes such as Base64 or embedded within protocol headers and fields without the use of encryption. Real-world threat actors including Lazarus Group, FIN8, APT32, Salt Typhoon, and Mustang Panda have leveraged FTP, HTTP POST, DNS tunneling, and SMTP for this purpose.

MITRE ATT&CK

Tactic
Exfiltration
Technique
T1048 Exfiltration Over Alternative Protocol
Sub-technique
T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
Canonical reference
https://attack.mitre.org/techniques/T1048/003/

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
let FtpTools = dynamic(["ftp.exe", "winscp.exe", "filezilla.exe", "winscp3.exe", "ncftp", "lftp"]);
let CurlWgetPatterns = dynamic(["curl ", "wget ", "Invoke-WebRequest", "curl.exe", "wget.exe"]);
let FtpExfilPatterns = dynamic(["--upload-file", "-T ", "PUT ", "STOR ", "-u ftp", "ftp://", "ftps://", "sftp://"]);
let DnsExfilPatterns = dynamic(["nslookup ", "Resolve-DnsName", "dig ", "dnscat", "iodine"]);
let SmtpExfilPatterns = dynamic(["smtp", "sendmail", "blat", "swaks", "Send-MailMessage"]);
let HttpExfilPatterns = dynamic(["--data-binary", "--data @", "-d @", "multipart/form-data", "-F file", "--form"]);
// Detection 1: FTP client usage with suspicious data transfer flags
let FtpExfil = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName has_any (FtpTools) or ProcessCommandLine has_any (["ftp://", "--ftp-upload", "-T ftp"])
| where ProcessCommandLine has_any (FtpExfilPatterns) or FileName has_any (FtpTools)
| extend ExfilMethod = "FTP"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, ExfilMethod;
// Detection 2: curl/wget uploading data over HTTP (not HTTPS)
let HttpExfil = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName has_any (["curl.exe", "curl", "wget.exe", "wget"])
| where ProcessCommandLine has_any (HttpExfilPatterns)
       or (ProcessCommandLine matches regex @"http://[^\s]+" and ProcessCommandLine has_any (["--upload-file", "-T ", "--data", "-d ", "--form", "-F "]))
| extend ExfilMethod = "HTTP_Upload"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, ExfilMethod;
// Detection 3: DNS-based exfiltration tools
let DnsExfil = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName has_any (["nslookup.exe", "nslookup", "dnscat", "iodine", "dns2tcp"])
       or ProcessCommandLine has_any (DnsExfilPatterns)
| where ProcessCommandLine matches regex @"[A-Za-z0-9+/]{20,}\.[a-z]{2,}"
       or ProcessCommandLine has_any (["dnscat", "iodine", "dns2tcp", "dnstunnel"])
| extend ExfilMethod = "DNS_Tunnel"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, ExfilMethod;
// Detection 4: SMTP/email-based exfiltration
let SmtpExfil = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName has_any (["blat.exe", "swaks", "sendmail", "msmtp"]) or ProcessCommandLine has_any (SmtpExfilPatterns)
| where ProcessCommandLine has_any (["-server", "-to ", "--to ", "-attach", "--attach", "-body", "--body"])
| extend ExfilMethod = "SMTP"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, ExfilMethod;
// Detection 5: Large outbound data via network connections on plaintext ports
let PlaintextNetworkExfil = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemotePort in (21, 25, 69, 80, 110, 143, 8080, 8000, 8888, 2121)
| where RemoteIPType == "Public"
| where InitiatingProcessFileName !in~ ("svchost.exe", "services.exe", "lsass.exe", "MsMpEng.exe", "chrome.exe", "msedge.exe", "firefox.exe", "iexplore.exe")
| extend ExfilMethod = case(
    RemotePort in (21, 2121), "FTP",
    RemotePort in (25, 110, 143), "Email_Protocol",
    RemotePort == 69, "TFTP",
    RemotePort in (80, 8080, 8000, 8888), "HTTP",
    "Unknown_Plaintext")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl, ExfilMethod;
union FtpExfil, HttpExfil, DnsExfil, SmtpExfil, PlaintextNetworkExfil
| sort by Timestamp desc
high severity medium confidence

Detects data exfiltration over unencrypted protocols (FTP, HTTP, SMTP, DNS, TFTP) using Microsoft Defender for Endpoint telemetry. The query uses a union of five detection branches: (1) FTP client tools with upload indicators, (2) curl/wget HTTP upload patterns to plaintext URLs, (3) DNS tunneling tool usage or base64-heavy DNS queries, (4) SMTP exfiltration via command-line mail tools, and (5) suspicious outbound network connections to public IPs on known plaintext protocol ports from non-browser processes. Each result is annotated with the suspected exfiltration method.

Data Sources

Process: Process CreationNetwork Traffic: Network Connection CreationCommand: Command ExecutionMicrosoft Defender for Endpoint

Required Tables

DeviceProcessEventsDeviceNetworkEvents

False Positives & Tuning

  • Legitimate FTP file transfers by IT operations teams using WinSCP or FileZilla to upload builds to internal FTP servers
  • Web developers or DevOps engineers using curl or wget to upload files to HTTP-based staging servers or artifact repositories
  • Monitoring agents or backup tools making HTTP connections on non-standard ports to internal infrastructure that happens to use plaintext
  • Network scanning or vulnerability assessment tools that probe FTP/HTTP ports on public IPs as part of authorized engagements
  • Internal mail relay servers or legacy applications using SMTP on port 25 for legitimate notification emails
Download portable Sigma rule (.yml)

Other platforms for T1048.003

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1FTP File Exfiltration Using Native Windows FTP Client

    Expected signal: Sysmon Event ID 1: Process Create with Image=ftp.exe, CommandLine containing '-s:%TEMP%\ftp_script.txt'. Sysmon Event ID 11: File Create for ftp_script.txt. Sysmon Event ID 3: Network Connection attempt to 127.0.0.1:21 (may not appear if connection immediately refused). Security Event ID 4688 if command line auditing enabled.

  2. Test 2HTTP POST File Upload via curl to Plaintext Endpoint

    Expected signal: Sysmon Event ID 1: Process Create with Image=curl.exe, CommandLine containing '--upload-file' and 'http://127.0.0.1:8080/upload'. Sysmon Event ID 3: Network Connection to 127.0.0.1:8080 from curl.exe. The connection will be refused but process and network events will still be logged.

  3. Test 3DNS Subdomain Exfiltration via nslookup

    Expected signal: Sysmon Event ID 1: Process Create for powershell.exe and child nslookup.exe with a long base64-like subdomain in the command line. Sysmon Event ID 22: DNS query event showing the long subdomain query. The query will fail (NXDOMAIN or timeout) but all telemetry is generated.

  4. Test 4SMTP Email Exfiltration via PowerShell Send-MailMessage

    Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Send-MailMessage', '-SmtpServer', and '-Attachments'. Sysmon Event ID 3: Network Connection attempt to 127.0.0.1:25. PowerShell ScriptBlock Log Event ID 4104 with the full Send-MailMessage command and parameters including attachment path.

  5. Test 5Data Staging and FTP Exfiltration via WinSCP Script (Linux/macOS via curl)

    Expected signal: Linux auditd or Sysmon for Linux Event ID 1: Process Create for tar, then curl with --upload-file and ftp:// URL. Syslog or auditd SYSCALL records for execve of curl with FTP arguments. Network connection attempt to 127.0.0.1:21. File creation events for the tar archive.

Last updated: 2026-04-16 Research depth: deep
References (12)

Unlock Pro Content

Get the full detection package for T1048.003 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Parent Technique

T1048Exfiltration Over Alternative Protocol

Related Sub-techniques

T1048.001Exfiltration Over Symmetric Encrypted Non-C2 ProtocolT1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Related Techniques

T1048Exfiltration Over Alternative ProtocolT1048.001Exfiltration Over Symmetric Encrypted Non-C2 ProtocolT1048.002Exfiltration Over Asymmetric Encrypted Non-C2 ProtocolT1041Exfiltration Over C2 ChannelT1071.001Web ProtocolsT1071.002File Transfer ProtocolsT1071.004DNST1560Archive Collected DataT1005Data from Local SystemT1074Data StagedT1567Exfiltration Over Web ServiceT1020Automated Exfiltration

Same Tactic: Exfiltration

Popular Detections