T1041 — Exfiltration Over C2 Channel
T1041: Exfiltration Over C2 Channel
MITRE ATT&CK® Enterprise technique
| Tactics | Exfiltration |
| Platforms | ESXi, Linux, macOS, Windows |
| Permissions required | — |
| Version | 2.3 |
Description
Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.
Detection
(no detection guidance published)
Data sources
- (none listed)
References
- ATT&CK page: https://attack.mitre.org/techniques/T1041
- ATT&CK Enterprise matrix: https://attack.mitre.org/matrices/enterprise/
See all 697 pages under Attacker techniques (ATT&CK) →
Related pages
Browse by topic
Every page in the corpus, grouped. Search finds one page; this shows what else is here.