T1041 Exfiltration Over C2 Channel
EnterpriseAdversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
mitigations
ATT&CK mitigations that reduce this.
detected by (5)
Data components that detect this.
countered by (D3FEND)
D3FEND countermeasures that counter this.
Detect
Isolate
Deceive
Restore
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- PR.DSData Securitystrong · backed by 10 of 18 mapped controls
- DE.CMContinuous Monitoringmoderate · backed by 6 of 18 mapped controls
- ID.AMAsset Managementmoderate · backed by 5 of 18 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
mitigating controls (18)
Security controls that mitigate this.
known-exploited CVEs (12)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-33053US | —OT critical | KEV | ||
External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2025-32756US | critical9.8OT critical | KEV | ||
A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMa… | ||||
| CVE-2024-55550US | low2.7OT critical | KEV | ||
Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successfu… | ||||
| CVE-2024-27443US | medium6.1OT critical | KEV | ||
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic us… | ||||
| CVE-2024-4577US | critical9.8OT critical | KEV | ||
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows m… | ||||
| CVE-2023-5631US | medium5.4OT critical | KEV | ||
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_… | ||||
| CVE-2023-38831US | high7.8OT critical | KEV | ||
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may inc… | ||||
| CVE-2023-2868US | critical9.8OT critical | KEV | ||
A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerabili… | ||||
| CVE-2023-1389US | high8.8OT critical | KEV | ||
TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoin… | ||||
| CVE-2019-18935US | critical9.8OT critical | KEV | ||
Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys… | ||||
| CVE-2019-0604US | critical9.8OT critical | KEV | ||
A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote… | ||||
| CVE-2018-4878US | high7.8OT critical | KEV | ||
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media pla… | ||||
groups (28)
Threat groups associated with this.
software (173)
Malware and tools associated with this.
campaigns (10)
Campaigns that use this.
Detected by (Sigma) (5)
Sigma detection rules related to this.
source
Where this definition is published.