Detect Exfiltration Over Unencrypted Non-C2 Protocol in Sumo Logic CSE
Adversaries may steal data by exfiltrating it over an unencrypted network protocol other than that of the existing command and control channel. Common protocols used include HTTP, FTP, SMTP, DNS, and TFTP. Data may be obfuscated using encoding schemes such as Base64 or embedded within protocol headers and fields without the use of encryption. Real-world threat actors including Lazarus Group, FIN8, APT32, Salt Typhoon, and Mustang Panda have leveraged FTP, HTTP POST, DNS tunneling, and SMTP for this purpose.
MITRE ATT&CK
- Tactic
- Exfiltration
- Sub-technique
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- Canonical reference
- https://attack.mitre.org/techniques/T1048/003/
Sumo Detection Query
(_sourceCategory=*windows* OR _sourceCategory=*sysmon* OR _sourceCategory=*endpoint*)
| where EventCode in ("1", "3") OR EventID in ("1", "3")
| eval IsFtpExfil = if(
matches(Image, "(?i)(ftp\\.exe|winscp\\.exe|filezilla\\.exe|ncftp|lftp)") OR
matches(CommandLine, "(?i)(ftp://|ftps://|--ftp-upload|--upload-file|-T ftp|STOR )"),
1, 0)
| eval IsHttpExfil = if(
matches(Image, "(?i)(curl\\.exe|wget\\.exe|curl|wget)") AND
matches(CommandLine, "(?i)(--upload-file|-T http://|--data-binary|--data @|-d @|--form|-F file=|multipart)") AND
matches(CommandLine, "http://"),
1, 0)
| eval IsDnsExfil = if(
matches(Image, "(?i)(nslookup\\.exe|dnscat|iodine|dns2tcp|dnstunnel)") OR
matches(CommandLine, "(?i)(dnscat|iodine|dns2tcp)"),
1, 0)
| eval IsSmtpExfil = if(
matches(Image, "(?i)(blat\\.exe|swaks|sendmail|msmtp)") OR
(matches(CommandLine, "(?i)(smtp|Send-MailMessage|sendmail)") AND
matches(CommandLine, "(?i)(-attach|--attach|-to |--to |-server)")),
1, 0)
| eval IsPlaintextNet = if(
!isNull(DestinationPort) AND
DestinationPort in ("21","25","69","80","110","143","2121","8080","8000","8888") AND
!matches(DestinationIp, "^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.|127\\.)") AND
!matches(Image, "(?i)(chrome\\.exe|firefox\\.exe|msedge\\.exe|iexplore\\.exe|svchost\\.exe|services\\.exe)"),
1, 0)
| eval ExfilMethod = if(IsFtpExfil=1, "FTP",
if(IsHttpExfil=1, "HTTP_Upload",
if(IsDnsExfil=1, "DNS_Tunnel",
if(IsSmtpExfil=1, "SMTP",
if(IsPlaintextNet=1, "Plaintext_Network", "Unknown")))))
| where ExfilMethod != "Unknown"
| eval SuspicionScore = IsFtpExfil + IsHttpExfil + IsDnsExfil + IsSmtpExfil
| fields _messageTime, Computer, User, Image, CommandLine, ParentImage, ParentCommandLine, DestinationIp, DestinationPort, ExfilMethod, SuspicionScore
| sort by _messageTime descSumo Logic detection for T1048.003 that evaluates Sysmon process creation (EventCode 1) and network connection (EventCode 3) events. Uses eval logic to score and classify four exfiltration methods: FTP client tool usage, curl/wget plain-HTTP upload operations, DNS tunneling utilities, and SMTP exfiltration mailers. Separately flags plaintext-port outbound connections to external IPs from non-browser processes. SuspicionScore field enables multi-method correlation.
Data Sources
Required Tables
False Positives & Tuning
- Automated patch management or software deployment workflows using plain HTTP or FTP to push packages to endpoints via internal distribution servers exposed on non-RFC1918 addresses
- Security research or malware analysis sandboxes running FTP, DNS, or SMTP exfiltration tools in controlled detonation environments without source category exclusions
- Legacy enterprise applications relying on SMTP (blat, sendmail) or FTP for routine scheduled data exports to authorized third-party partners
Other platforms for T1048.003
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1FTP File Exfiltration Using Native Windows FTP Client
Expected signal: Sysmon Event ID 1: Process Create with Image=ftp.exe, CommandLine containing '-s:%TEMP%\ftp_script.txt'. Sysmon Event ID 11: File Create for ftp_script.txt. Sysmon Event ID 3: Network Connection attempt to 127.0.0.1:21 (may not appear if connection immediately refused). Security Event ID 4688 if command line auditing enabled.
- Test 2HTTP POST File Upload via curl to Plaintext Endpoint
Expected signal: Sysmon Event ID 1: Process Create with Image=curl.exe, CommandLine containing '--upload-file' and 'http://127.0.0.1:8080/upload'. Sysmon Event ID 3: Network Connection to 127.0.0.1:8080 from curl.exe. The connection will be refused but process and network events will still be logged.
- Test 3DNS Subdomain Exfiltration via nslookup
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe and child nslookup.exe with a long base64-like subdomain in the command line. Sysmon Event ID 22: DNS query event showing the long subdomain query. The query will fail (NXDOMAIN or timeout) but all telemetry is generated.
- Test 4SMTP Email Exfiltration via PowerShell Send-MailMessage
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Send-MailMessage', '-SmtpServer', and '-Attachments'. Sysmon Event ID 3: Network Connection attempt to 127.0.0.1:25. PowerShell ScriptBlock Log Event ID 4104 with the full Send-MailMessage command and parameters including attachment path.
- Test 5Data Staging and FTP Exfiltration via WinSCP Script (Linux/macOS via curl)
Expected signal: Linux auditd or Sysmon for Linux Event ID 1: Process Create for tar, then curl with --upload-file and ftp:// URL. Syslog or auditd SYSCALL records for execve of curl with FTP arguments. Network connection attempt to 127.0.0.1:21. File creation events for the tar archive.
References (12)
- https://attack.mitre.org/techniques/T1048/003/
- https://attack.mitre.org/techniques/T1048/
- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fundamentals/command/cf_command_ref/C_commands.html#wp1068167689
- https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
- https://www.mandiant.com/resources/blog/cutting-edge-part-2
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1048.003/T1048.003.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection
- https://unit42.paloaltonetworks.com/cookieminer/
- https://securelist.com/faq-the-projectsauron-apt/75533/
- https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/
- https://blog.checkpoint.com/security/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/
- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fundamentals/command/cf_command_ref/C_commands.html
Unlock Pro Content
Get the full detection package for T1048.003 including response playbook, investigation guide, and atomic red team tests.