T1041 Exfiltration Over C2 Channel
EnterpriseAdversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.
Plattformen
Plattformen, für die dies gilt.
Taktiken
ATT&CK-Taktiken, denen diese Technik dient.
Gegenmaßnahmen
ATT&CK-Gegenmaßnahmen, die dies verringern.
Erkannt durch (5)
Datenkomponenten, die dies erkennen.
Abgewehrt durch (D3FEND)
D3FEND-Gegenmaßnahmen dagegen.
Detect
Isolate
Deceive
Restore
NIST CSF 2.0 — Relevanzbereiche (Protect / Detect)
NIST-CSF-2.0-Bereiche mit dem größten Bezug (belegbasiert).
- PR.DSData Securitystark · gestützt durch 10 von 18 zugeordneten Controls
- DE.CMContinuous Monitoringmoderat · gestützt durch 6 von 18 zugeordneten Controls
- ID.AMAsset Managementmoderat · gestützt durch 5 von 18 zugeordneten Controls
Abgeleitet aus MITRE CTID (Apache-2.0) und dem NIST-800-53-↔-CSF-Crosswalk (gemeinfrei). Eine indikative Relevanz entlang der Protect-/Detect-Achse — keine Compliance-Bewertung und keine Abdeckungsaussage.
Mindernde Maßnahmen (18)
Sicherheitskontrollen, die dies mindern.
bekannt ausgenutzte CVEs (12)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-33053US | —OT kritisch | KEV | ||
External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2025-32756US | critical9.8OT kritisch | KEV | ||
A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMa… | ||||
| CVE-2024-55550US | low2.7OT kritisch | KEV | ||
Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successfu… | ||||
| CVE-2024-27443US | medium6.1OT kritisch | KEV | ||
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic us… | ||||
| CVE-2024-4577US | critical9.8OT kritisch | KEV | ||
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows m… | ||||
| CVE-2023-5631US | medium5.4OT kritisch | KEV | ||
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_… | ||||
| CVE-2023-38831US | high7.8OT kritisch | KEV | ||
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may inc… | ||||
| CVE-2023-2868US | critical9.8OT kritisch | KEV | ||
A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerabili… | ||||
| CVE-2023-1389US | high8.8OT kritisch | KEV | ||
TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoin… | ||||
| CVE-2019-18935US | critical9.8OT kritisch | KEV | ||
Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys… | ||||
| CVE-2019-0604US | critical9.8OT kritisch | KEV | ||
A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote… | ||||
| CVE-2018-4878US | high7.8OT kritisch | KEV | ||
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media pla… | ||||
Gruppen (28)
Zugehörige Bedrohungsgruppen.
Software (173)
Zugehörige Malware und Tools.
Kampagnen (10)
Kampagnen, die dies verwenden.
Erkannt durch (Sigma) (5)
Zugehörige Sigma-Erkennungsregeln.
Quelle
Wo diese Definition veröffentlicht ist.