T1041 Exfiltration Over C2 Channel — Attack Simulation

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

Text Based Data Exfiltration using DNS subdomains
windows automated powershell
Procedure c9207f3e-213d-4cc7-ad2a-7697a7237df9; elevation not declared required; cleanup not declared. Not executed or individually validated.
C2 Data Exfiltration
windows automated powershell
Procedure d1253f6e-c29b-49dc-b466-2147a6191932; elevation not declared required; cleanup not declared. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise cloud-hosted-endpoint onprem virtualization ESXi Linux macOS Windows exfiltration isolated_authorized_lab procedure_review_required telemetry_configuration_required

can_simulate technique source_mapped

Detection and collection

T1041 detection workspace

Attack tools

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Connected anomaly research

Curated research views reached through an exact source technique, a catalog model, or a reviewed collection reference. These are navigation associations, not claims of detector effectiveness or sensor equivalence.

Telemetry contracts · Maintained query examples · Validation and blind spots

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.