Detect Exfiltration Over Unencrypted Non-C2 Protocol in Splunk
Adversaries may steal data by exfiltrating it over an unencrypted network protocol other than that of the existing command and control channel. Common protocols used include HTTP, FTP, SMTP, DNS, and TFTP. Data may be obfuscated using encoding schemes such as Base64 or embedded within protocol headers and fields without the use of encryption. Real-world threat actors including Lazarus Group, FIN8, APT32, Salt Typhoon, and Mustang Panda have leveraged FTP, HTTP POST, DNS tunneling, and SMTP for this purpose.
MITRE ATT&CK
- Tactic
- Exfiltration
- Sub-technique
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- Canonical reference
- https://attack.mitre.org/techniques/T1048/003/
SPL Detection Query
index=wineventlog (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 OR sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3)
| eval ExfilMethod="Unknown"
| eval IsFtpExfil=if(match(Image, "(?i)(ftp\.exe|winscp\.exe|filezilla\.exe|ncftp|lftp)") OR match(CommandLine, "(?i)(ftp://|--ftp-upload|--upload-file|-T ftp|STOR )"), 1, 0)
| eval IsHttpExfil=if(match(Image, "(?i)(curl\.exe|wget\.exe)") AND match(CommandLine, "(?i)(--upload-file|-T http://|--data-binary|--data @|-d @|--form|-F file=|multipart)") AND match(CommandLine, "http://"), 1, 0)
| eval IsDnsExfil=if(match(Image, "(?i)(nslookup\.exe|dnscat|iodine|dns2tcp|dnstunnel)") OR match(CommandLine, "(?i)(dnscat|iodine|dns2tcp)"), 1, 0)
| eval IsSmtpExfil=if(match(Image, "(?i)(blat\.exe|swaks|sendmail|msmtp)") OR (match(CommandLine, "(?i)(smtp|Send-MailMessage|sendmail)" ) AND match(CommandLine, "(?i)(-attach|--attach|-to |--to |-server)")) , 1, 0)
| eval ExfilMethod=case(
IsFtpExfil=1, "FTP",
IsHttpExfil=1, "HTTP_Upload",
IsDnsExfil=1, "DNS_Tunnel",
IsSmtpExfil=1, "SMTP",
EventCode=3 AND (match(DestinationPort, "^(21|25|69|80|110|143|8080|8000|8888|2121)$")) AND NOT match(DestinationIp, "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)"), "Plaintext_Network",
true(), "Unknown")
| where ExfilMethod!="Unknown"
| eval SuspicionScore=IsFtpExfil + IsHttpExfil + IsDnsExfil + IsSmtpExfil
| eval IsExternalDest=if(EventCode=3 AND NOT match(DestinationIp, "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)"), 1, 0)
| where IsFtpExfil=1 OR IsHttpExfil=1 OR IsDnsExfil=1 OR IsSmtpExfil=1 OR (ExfilMethod="Plaintext_Network" AND NOT match(Image, "(?i)(chrome\.exe|firefox\.exe|msedge\.exe|iexplore\.exe|svchost\.exe|services\.exe)"))
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, DestinationIp, DestinationPort, ExfilMethod, SuspicionScore
| sort - _timeDetects data exfiltration over unencrypted protocols using Sysmon Event ID 1 (Process Creation) and Event ID 3 (Network Connection) logs. Evaluates process image names and command lines for FTP upload tools, curl/wget HTTP uploads, DNS tunneling tools, and SMTP command-line mailers. Also identifies outbound network connections to public IPs on plaintext protocol ports (21, 25, 69, 80, 110, 143, etc.) from non-browser processes. Results are classified by exfiltration method and scored for triage prioritization.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate FTP file transfers by IT operations teams using WinSCP or FileZilla to upload builds to internal FTP servers
- Web developers or DevOps engineers using curl or wget to upload files to HTTP-based staging servers or artifact repositories
- Monitoring agents or backup tools making HTTP connections on non-standard ports to internal infrastructure that happens to use plaintext
- Network scanning or vulnerability assessment tools that probe FTP/HTTP ports on public IPs as part of authorized engagements
- Internal mail relay servers or legacy applications using SMTP on port 25 for legitimate notification emails
Other platforms for T1048.003
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1FTP File Exfiltration Using Native Windows FTP Client
Expected signal: Sysmon Event ID 1: Process Create with Image=ftp.exe, CommandLine containing '-s:%TEMP%\ftp_script.txt'. Sysmon Event ID 11: File Create for ftp_script.txt. Sysmon Event ID 3: Network Connection attempt to 127.0.0.1:21 (may not appear if connection immediately refused). Security Event ID 4688 if command line auditing enabled.
- Test 2HTTP POST File Upload via curl to Plaintext Endpoint
Expected signal: Sysmon Event ID 1: Process Create with Image=curl.exe, CommandLine containing '--upload-file' and 'http://127.0.0.1:8080/upload'. Sysmon Event ID 3: Network Connection to 127.0.0.1:8080 from curl.exe. The connection will be refused but process and network events will still be logged.
- Test 3DNS Subdomain Exfiltration via nslookup
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe and child nslookup.exe with a long base64-like subdomain in the command line. Sysmon Event ID 22: DNS query event showing the long subdomain query. The query will fail (NXDOMAIN or timeout) but all telemetry is generated.
- Test 4SMTP Email Exfiltration via PowerShell Send-MailMessage
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Send-MailMessage', '-SmtpServer', and '-Attachments'. Sysmon Event ID 3: Network Connection attempt to 127.0.0.1:25. PowerShell ScriptBlock Log Event ID 4104 with the full Send-MailMessage command and parameters including attachment path.
- Test 5Data Staging and FTP Exfiltration via WinSCP Script (Linux/macOS via curl)
Expected signal: Linux auditd or Sysmon for Linux Event ID 1: Process Create for tar, then curl with --upload-file and ftp:// URL. Syslog or auditd SYSCALL records for execve of curl with FTP arguments. Network connection attempt to 127.0.0.1:21. File creation events for the tar archive.
References (12)
- https://attack.mitre.org/techniques/T1048/003/
- https://attack.mitre.org/techniques/T1048/
- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fundamentals/command/cf_command_ref/C_commands.html#wp1068167689
- https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
- https://www.mandiant.com/resources/blog/cutting-edge-part-2
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1048.003/T1048.003.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection
- https://unit42.paloaltonetworks.com/cookieminer/
- https://securelist.com/faq-the-projectsauron-apt/75533/
- https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/
- https://blog.checkpoint.com/security/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/
- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fundamentals/command/cf_command_ref/C_commands.html
Unlock Pro Content
Get the full detection package for T1048.003 including response playbook, investigation guide, and atomic red team tests.