1200KM / detection
Detection workspace for T1041 Exfiltration Over C2 Channel: 2 Sigma sources, 1 Atlas concepts and 1 anomaly models. No live detection validation.
SUM(outbound_bytes BY source_host AND destination, 15m) >= threshold AND destination NOT_IN approved_destinations -> ALERTComparison unit: source-destination flow.
Expected behavior: outbound byte volume and destination relationships remain within an entity's normal range.
Deviation: extreme volume, new edge, or abrupt level shift.
Identifies suspicious outbound traffic volume mismatches from processes that typically do not generate network activity, particularly over C2 protocols like HTTPS, DNS, or custom TCP/UDP ports, following file or data access.
Monitors for processes reading sensitive files then immediately initiating unusual outbound connections or bulk transfer sessions over persistent sockets, particularly with encrypted or binary payloads.
Detects unauthorized applications or scripts accessing sensitive data followed by establishing encrypted outbound communication to rare external destinations or with abnormal byte ratios.
Detects VMs sending outbound traffic through non-standard services or to unknown destinations. Exfiltration over reverse shells tunneled via VMkernel or custom payloads routed via hostd/vpxa.
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Collection configuration and event examples · Anomaly models and design worksheet · Tools and documented software · Simulation procedures · Offline synthetic collection check
Exact source tags are not semantic relevance verdicts. Review actual rule conditions and observation points; imported rules are not backend-compiled or live-validated.
Curated research views reached through an exact source technique, a catalog model, or a reviewed collection reference. These are navigation associations, not claims of detector effectiveness or sensor equivalence.
Telemetry contracts · Maintained query examples · Validation and blind spots
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.