{"source_checked_on":"2026-10-19","schema_version":1,"key":"mobile/T1639","id":"T1639","name":"Exfiltration Over Alternative Protocol","domain":"mobile","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1639","source_file":{"file":"mobile.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/mobile-attack/mobile-attack-20.0.json","sha256":"824f7d8a37e7893b29e4c6ca6d87b5fbbf3b228ec6384f1a69ee20d523ff59e5","bytes":6095145},"source_object_sha256":"07ed58071366bc5910e8b9f47fb1537c1301f3df87c42540d67ed3a596d22835","description":"Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. \n\nAlternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Different protocol channels could also include Web services such as cloud storage. Adversaries may opt to also encrypt and/or obfuscate these alternate channels. ","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1639","external_id":"T1639"},{"source_name":"NIST Mobile Threat Catalogue","url":"https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-30.html","external_id":"APP-30"}],"platforms":["Android","iOS"],"environments":["mobile"],"visibility":"no_standard_source_mapping","visibility_note":"Analyst-proposed lab instrumentation, not an official ATT&CK component mapping or a validated detection. It may observe effects without establishing malicious intent.","parent":null,"children":[{"key":"mobile/T1639.001","id":"T1639.001","name":"Exfiltration Over Unencrypted Non-C2 Protocol","page":"techniques/mobile/T1639.001/"}],"telemetry":[{"id":"proposed-lab-gateway-network-flows","name":"Lab gateway network flows","page":"telemetry/proposed-lab-gateway-network-flows/","kind":"proposed_input","category":"Network and protocol telemetry","description":"Flow observations at the mobile/OT lab gateway.","collection_focus":"Mirror the isolated lab egress and preserve device address leases/NAT mapping, byte counters and observation direction.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["gateway","device_ip","destination_ip","bytes_sent"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-lab-gateway-network-flows","collector":"illustrative-lab-collector","observation":{"gateway":"lab-gw-1","device_ip":"192.0.2.10","destination_ip":"198.51.100.20","bytes_sent":128}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"proposed_input","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"proposed-protocol-aware-egress-monitoring","name":"Protocol-aware egress monitoring","page":"telemetry/proposed-protocol-aware-egress-monitoring/","kind":"proposed_input","category":"Network and protocol telemetry","description":"Outbound traffic enriched by a supported application/industrial protocol parser.","collection_focus":"Enable only the required protocol analyzers on mirrored lab traffic; record parser/version, decode failures and encrypted/unknown flows.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","direction","function_code","decode_status"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-protocol-aware-egress-monitoring","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"modbus","direction":"lab_egress","function_code":3,"decode_status":"ok"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"proposed_input","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."}],"detection":{"key":"mobile/T1639","id":"T1639","name":"Exfiltration Over Alternative Protocol","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"source_url":"https://attack.mitre.org/techniques/T1639","technique_page":"techniques/mobile/T1639/","page":"detections/mobile/T1639/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0698","name":"Detection of Exfiltration Over Alternative Protocol","url":"https://attack.mitre.org/detectionstrategies/DET0698","stix_id":"x-mitre-detection-strategy--7f914be4-061a-43a7-8d36-a758b123ca3b","relationship_id":"relationship--6b7783d9-415c-4134-b984-b7dac929c59d","description":"","analytics":[{"id":"AN1813","name":"Analytic 1813","guidance":"Exfiltration Over Alternative Protocols can be difficult to detect, and therefore enterprises may be better served focusing on detection at other stages of adversarial behavior.","url":"https://attack.mitre.org/detectionstrategies/DET0698#AN1813","platforms":["Android"],"tuning":[],"log_sources":[]},{"id":"AN1814","name":"Analytic 1814","guidance":"Exfiltration Over Alternative Protocols can be difficult to detect, and therefore enterprises may be better served focusing on detection at other stages of adversarial behavior.","url":"https://attack.mitre.org/detectionstrategies/DET0698#AN1814","platforms":["iOS"],"tuning":[],"log_sources":[]}]}],"telemetry_references":[{"id":"proposed-lab-gateway-network-flows","name":"Lab gateway network flows","tag":"Proposed: Lab gateway network flows","page":"telemetry/proposed-lab-gateway-network-flows/","kind":"proposed_input"},{"id":"proposed-protocol-aware-egress-monitoring","name":"Protocol-aware egress monitoring","tag":"Proposed: Protocol-aware egress monitoring","page":"telemetry/proposed-protocol-aware-egress-monitoring/","kind":"proposed_input"}],"visibility":"no_standard_source_mapping","visibility_note":"Analyst-proposed lab instrumentation, not an official ATT&CK component mapping or a validated detection. It may observe effects without establishing malicious intent.","tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S1056","name":"TianySpy","url":"https://attack.mitre.org/software/S1056","kind":"malware","description":"[TianySpy](https://attack.mitre.org/software/S1056) can exfiltrate collected user data, including credentials and authorized cookies, via email.(Citation: trendmicro_tianyspy_0122) ","relationship_id":"relationship--8bc21e5d-b6bb-4c93-9419-19a12061de52","references":[{"source_name":"trendmicro_tianyspy_0122","description":"Trend Micro. (2022, January 25). TianySpy Malware Uses Smishing Disguised as Message From Telco. Retrieved January 11, 2023.","url":"https://www.trendmicro.com/en_us/research/22/a/tianyspy-malware-uses-smishing-disguised-as-message-from-telco.html"}]}],"actors":[],"mitigations":[],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use owned test devices or emulators, disposable app accounts and test data. Verify platform/version instrumentation; desktop test procedures do not establish mobile coverage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1639":"/ttp-simulation/techniques/mobile/T1639/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"mobile/T1639","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-lab-gateway-network-flows","collector":"illustrative-lab-collector","observation":{"gateway":"lab-gw-1","device_ip":"192.0.2.10","destination_ip":"198.51.100.20","bytes_sent":128}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-protocol-aware-egress-monitoring","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"modbus","direction":"lab_egress","function_code":3,"decode_status":"ok"}}]}}