Exfiltration Over C2 Channel

Rather than opening a separate channel for stealing data, this is exfiltration folded directly into whatever command-and-control channel the attacker is already using. The same connection that carries commands in also carries stolen data out.

The advantage for an attacker is simplicity: no second channel to build or hide, and if the C2 channel itself is already blending into normal traffic, the exfiltrated data rides along with it.

Once data is staged and ready to leave, an attacker sends it back over the existing C2 connection rather than standing up something new. It is often broken into chunks to avoid a single obviously-large transfer, and timed to blend into the C2 channel's normal check-in cadence rather than happening all at once.

Because the channel is already established and (from the attacker's perspective) already working, this is frequently the path of least resistance for exfiltration once other options for staging and access have already succeeded.

Data source: Host-side: the file-creation record for the staged copy, the file-share read on the server it came from, and the outbound network-connection record from the staging host -- the connection and the file creation share a process id within the same second, which is what ties them together. Network-side: the sensor's HTTP transaction record for the upload itself, carrying the method, target path and transferred size.

{
  "dns": {
    "question": {
      "name": "chunk047-9f2a.attacker-c2.net",
      "type": "TXT"
    }
  },
  "host": {
    "name": "APP01"
  },
  "event": {
    "action": "dns_query",
    "category": "network"
  },
  "source": {
    "ip": "10.1.10.13"
  }
}

Prebuilt Elastic rule: DNS Tunneling

This technique is best hunted as a follow-on to identifying the C2 channel itself, not independently. Once a suspicious C2 channel is confirmed, look at its volume trend over time. A channel that's been carrying small, regular check-ins suddenly carrying a sustained volume increase is consistent with data now moving out over it.

Hunting manually: for any host already flagged for suspicious C2-channel activity, plot query/connection volume over the session's lifetime. A step change upward, rather than a steady baseline, is the signal that exfiltration (not just beaconing) is now happening.

Because this technique is entirely dependent on the underlying C2 channel, false positives here are really false positives on the channel identification itself. See the specific channel's own page (DNS, HTTP, etc.) for what normal traffic looks like on that channel.

Once a channel is genuinely confirmed as C2, a volume increase on it has very little benign explanation, since legitimate services don't typically show a sudden sustained volume spike on what's already been identified as anomalous traffic. The main thing worth double-checking is that the underlying channel identification itself was correct before escalating on volume alone.

• MITRE ATT&CK T1041: Exfiltration Over C2 Channel
• Elastic Security: DNS Tunneling

1 scenario in this catalog covers T1041. We don't name it — identifying the technique is part of what a scenario grades. Explore the dashboard →