MITRE description

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.(Citation: C2 FRAMEWORKS)

KEV CVEs mapped to this technique

MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-11-04 ESET: SlippyNunchucks hijacks Sogou Input Method’s brand promotion mechanism to distribute malware
2026-11-03 Flare: Inside a Microsoft Lookalike Domain Masquerading as Czech Company’s IT Department Infrastructure
2026-10-30 Darktrace: CikaBika Bot: Inside a Discord RAT Campaign
2026-10-29 Cisco Talos: IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
2026-10-22 ESET: MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration
2026-10-22 Group-IB: Inside SiriusQT: A Seriously Skilled RAT
2026-10-19 Rapid7: Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779
2026-10-06 Flare: CrocoRat Adds a New Twist to ClickFix with DNS Payload Delivery
2026-09-24 Intel 471: 2026 SANS Threat Hunting Survey: Adversaries Prizing Stealth over Speed? Defenders Cooling on AI?
2026-09-17 ESET: Beware the SparroWock: The backdoor that bites, the commands that catch

Showing the 10 most recent of 15.

Detection coverage

SigmaHQ community rules

Equation Group C2 Communication (emerging-threats)
Shai-Hulud NPM Package Malicious Exfiltration via Curl (emerging-threats)
Tunneling Tool Execution (threat-hunting)
OpenCanary - TFTP Request (core)
Network Communication Initiated To Portmap.IO Domain (core)

Elastic and Splunk rules

Unusual AWS Command for a User (elastic)
Unusual Azure Activity Logs Event for a User (elastic)
Potential Data Exfiltration Activity to an Unusual ISO Code (elastic)
Potential Data Exfiltration Activity to an Unusual IP Address (elastic)
Potential Data Exfiltration Activity to an Unusual Destination Port (elastic)
Potential Data Exfiltration Activity to an Unusual Region (elastic)
Unusual GCP Event for a User (elastic)
Network Activity Detected via Kworker (elastic)
DNS Tunneling (elastic)
Spike in host-based traffic (elastic)
Spike in Firewall Denies (elastic)
Spike in Network Traffic (elastic)
Unusual Linux Network Activity (elastic)
Unusual Linux Network Port Activity (elastic)
Unusual Network Destination Domain Name (elastic)
Network Traffic to Rare Destination Country (elastic)
Spike in Network Traffic To a Country (elastic)
Unusual Windows Network Activity (elastic)
Cisco ASA - Device File Copy to Remote Location (splunk)
Potential Telegram API Request Via CommandLine (splunk)
Windows Exfiltration Over C2 Via Invoke RestMethod (splunk)
Windows Exfiltration Over C2 Via Powershell UploadString (splunk)
Cisco Secure Firewall - High EVE Threat Confidence (splunk)
Cisco Secure Firewall - Intrusion Events by Threat Activity (splunk)
Cisco Secure Firewall - Lumma Stealer Download Attempt (splunk)

Showing 25 of 27.

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.