T1646 Exfiltration Over C2 Channel — Attack Simulation

proposed-lab-gateway-network-flows collection page — Mirror the isolated lab egress and preserve device address leases/NAT mapping, byte counters and observation direction.

Providers and collection configuration

• Zeek: Connection and protocol metadata from traffic visible to the sensor.
• Suricata EVE: Configured flow, alert, DNS, HTTP, TLS and protocol records.
• AWS VPC Flow Logs: IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.

• Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.
• Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.
• Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection.

Required normalized fields: gateway, device_ip, destination_ip, bytes_sent.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "proposed-lab-gateway-network-flows",
  "collector": "illustrative-lab-collector",
  "observation": {
    "gateway": "lab-gw-1",
    "device_ip": "192.0.2.10",
    "destination_ip": "198.51.100.20",
    "bytes_sent": 128
  }
}

Visibility limits: Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.

proposed-outbound-transfer-volume-and-destination-context collection page — Aggregate outbound bytes with explicit window/direction and enrich from permitted destination metadata; preserve enrichment provenance.

Providers and collection configuration

• Zeek: Connection and protocol metadata from traffic visible to the sensor.
• Suricata EVE: Configured flow, alert, DNS, HTTP, TLS and protocol records.
• AWS VPC Flow Logs: IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.

• Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.
• Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.
• Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection.

Required normalized fields: device_id, window_seconds, outbound_bytes, destination, classification.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "proposed-outbound-transfer-volume-and-destination-context",
  "collector": "illustrative-lab-collector",
  "observation": {
    "device_id": "android-lab-1",
    "window_seconds": 60,
    "outbound_bytes": 4096,
    "destination": "198.51.100.20",
    "classification": "lab_endpoint"
  }
}

Visibility limits: Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.

MITRE detection strategy

No exact-tagged Sigma source rule was imported. This does not establish that the technique is undetectable; the MITRE guidance and collection requirements remain relevant.

• S0326 RedDrop — malware.

  RedDrop uses standard HTTP for exfiltration.[Wandera-RedDrop]

  Exact relationship: relationship--945db15a-b356-4e05-a6a0-9b24ca9aa348
• S0399 Pallas — malware.

  Pallas exfiltrates data using HTTP.[Lookout Dark Caracal Jan 2018]

  Exact relationship: relationship--fb587f81-1300-438d-a33b-f8d08530788b
• S0418 ViceLeaker — malware.

  ViceLeaker uses HTTP data exfiltration.[SecureList - ViceLeaker 2019][Bitdefender - Triout 2018]

  Exact relationship: relationship--41da5845-a1a8-4d10-8929-053be3496396
• S0421 GolfSpy — malware.

  GolfSpy exfiltrates data using HTTP POST requests.[Trend Micro Bouncing Golf 2019]

  Exact relationship: relationship--3dd0cd4d-bcde-4105-b98e-b32add191083
• S0424 Triada — malware.

  Triada utilized HTTP to exfiltrate data through POST requests to the command and control server.[Google Triada June 2019]

  Exact relationship: relationship--d32003ba-959b-4377-aa04-f75275c32abf
• S0490 XLoader for iOS — malware.

  XLoader for iOS has exfiltrated data using HTTP requests.[TrendMicro-XLoader-FakeSpy]

  Exact relationship: relationship--f517a7ce-dfdc-4f42-84c1-fef136e2ea19
• S0507 eSurv — malware.

  eSurv has exfiltrated data using HTTP PUT requests.[Lookout eSurv]

  Exact relationship: relationship--f1130c77-3d20-4c41-9e75-1953bf9b8abc
• S0551 GoldenEagle — malware.

  GoldenEagle has exfiltrated data via both SMTP and HTTP.[Lookout Uyghur Campaign]

  Exact relationship: relationship--0100020b-97d4-4657-bc71-c6a1774055a6
• S1054 Drinik — malware.

  Drinik can send stolen data back to the C2 server.[cyble_drinik_1022]

  Exact relationship: relationship--2b065fcf-7ed1-4f88-8910-2eb46bde9ab7
• S1055 SharkBot — malware.

  SharkBot can exfiltrate captured user credentials and event logs back to the C2 server. [nccgroup_sharkbot_0322]

  Exact relationship: relationship--0f70bdf1-a6a7-406c-a4c0-cee509ff8369
• S1061 AbstractEmu — malware.

  AbstractEmu can send large amounts of device data over its C2 channel, including the device’s manufacturer, model, version and serial number, telephone number, and IP address.[lookout_abstractemu_1021]

  Exact relationship: relationship--6bb4de7d-1ef9-4bc8-8d34-62e176d4188a
• S1067 FluBot — malware.

  FluBot can send contact lists to its C2 server.[proofpoint_flubot_0421]

  Exact relationship: relationship--e34c8c23-be8f-4da9-b051-5246e5f16ba8
• S1077 Hornbill — malware.

  Hornbill can exfiltrate data back to the C2 server using HTTP.[lookout_hornbill_sunbird_0221]

  Exact relationship: relationship--7bc6460d-b36e-41ed-baa0-82d54ec19e57
• S1079 BOULDSPY — malware.

  BOULDSPY has exfiltrated cached data from infected devices.[lookout_bouldspy_0423]

  Exact relationship: relationship--724e1b64-7c9b-4a8f-a2ab-3f9cab539e68
• S1080 Fakecalls — malware.

  Fakecalls can send exfiltrated data back to the C2 server.[kaspersky_fakecalls_0422]

  Exact relationship: relationship--b6323cf4-8141-4910-8743-e42cd15b49e9
• S1082 Sunbird — malware.

  Sunbird can exfiltrate compressed ZIP files containing gathered info to C2 infrastructure.[lookout_hornbill_sunbird_0221]

  Exact relationship: relationship--cbb07bef-f1da-41f6-b786-4a255e8bf985
• S1083 Chameleon — malware.

  Chameleon has sent stolen data over HTTP.[cyble_chameleon_0423]

  Exact relationship: relationship--3fdb8bfb-1b2d-4fac-bb41-d26a5ad18dbb
• S1093 FlyTrap — malware.

  FlyTrap can use HTTP to exfiltrate data to the C2 server.[Zimperium FlyTrap]

  Exact relationship: relationship--980430c1-6173-440e-b75e-c1cdb4c41560
• S1094 BRATA — malware.

  BRATA has exfiltrated data to the C2 server using HTTP requests.[cleafy_brata_0122]

  Exact relationship: relationship--98632824-9fe4-4992-aafe-31c5eac66ec1
• S1095 AhRat — malware.

  AhRat can exfiltrate collected data to the C2, such as audio recordings and files.[welivesecurity_ahrat_0523]

  Exact relationship: relationship--349c2f82-1166-4dab-88d0-cfe920804b70
• S1185 LightSpy — malware.

  LightSpy has exfiltrated collected data to the C2.[LinkedIn Dmitry LightSpy 2025]

  Exact relationship: relationship--5976af4f-2fd4-46a0-baab-a4ae69e98bc1
• S1215 Binary Validator — malware.

  Binary Validator has exfiltrated collected data to the C2 server.[SecureList OpTriangulation 23Oct2023]

  Exact relationship: relationship--f2e75022-ff16-44a8-8fcc-18c785406fb5
• S1225 CherryBlos — malware.

  CherryBlos has exfiltrated credentials collected from pictures that have been analyzed using optical character recognition (OCR).[TrendMicro_CherryBlos_July2023]

  Exact relationship: relationship--bb6e0232-8205-4ae8-80a8-659d33056ac8
• S1231 GodFather — malware.

  GodFather has exfiltrated sensitive information over C2.[ZimperiumOrtegaPratapagiri_GodFather_Jun2025][MerkleScience_Godfather_April2023]

  Exact relationship: relationship--66be8672-6075-4309-b287-c9b81249f610
• S1241 RatMilad — malware.

  RatMilad has exfiltrated collected data to the C2.[ZimperiumGupta_RatMilad_Oct2022]

  Exact relationship: relationship--3a13ea43-f3d7-4b12-93fa-65eb44d02b5e
• S9004 Crocodilus — malware.

  Crocodilus has the ability to send stolen data to C2.[ThreatFabric_Crocodilus_March2025]

  Exact relationship: relationship--1151b8cc-035b-46e2-ab5a-46e719ef97f8
• S9005 DocSwap — malware.

  DocSwap has used a hardcoded IP address and port for C2 and exfiltration over socket communication.[S2W_DocSwap_Mar2025]

  Exact relationship: relationship--e49f5d6a-4b8f-4649-9eb2-489524184feb
• S9006 VajraSpy — malware.

  VajraSpy has exfiltrated captured data to C2 via POST requests.[ESET_VajraSpy_Feb2024]

  Exact relationship: relationship--f33632d6-e0e7-4236-89da-0e41266c9a98
• S9040 NGate — malware.

  NGate has exfiltrated the victim’s payment card PIN to the C2 server via HTTP.[ESETStefanko_NGateVariant_Apr2026]

  Exact relationship: relationship--94077e81-4098-48fa-a1db-cd0c926a3d24