Techniques › T1048 › T1048.001

T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol

exfiltration — Linux, macOS, Windows, ESXi · attack.mitre.org · JSON

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

• DET0503 Behavioral Detection Strategy for Exfiltration Over Symmetric Encrypted Non-C2 Protocol v1.0
  AN1389 Windows

  Detects the execution of non-browser processes establishing outbound encrypted network connections using uncommon symmetric encryption protocols (e.g., AES via PowerShell or custom scripts) to alternate external destinations.

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: PayloadEntropyThreshold TimeWindow ExecutableAllowlist
  AN1390 Linux

  Detects command-line utilities or scripts using encryption libraries or symmetric algorithms (e.g., OpenSSL AES, GPG, Python + PyCrypto) in conjunction with outbound file transfers or traffic to external destinations.

  auditd:SYSCALL execve → DC0032 Process Creation

  auditd:SYSCALL connect → DC0082 Network Connection Creation

  NSM:Flow conn.log or flow data → DC0078 Network Traffic Flow

  NSM:Flow ssl.log (for TLS handshake analysis), dns.log (tunneling indicators) → DC0085 Network Traffic Content

  Tunable: FileTransferIndicator LibraryCallTracking
  AN1391 macOS

  Detects symmetric key-based encryption operations (e.g., AES via Python, AppleScript, or OpenSSL) followed by unusual outbound connections from non-browser applications or scripted tools.

  macos:unifiedlog log stream process subsystem → DC0032 Process Creation

  macos:osquery socket_events → DC0078 Network Traffic Flow

  macos:unifiedlog log stream network activity → DC0082 Network Connection Creation

  Tunable: ApplicationProfileBaseline EncryptionRoutinePattern
  AN1392 ESXi

  Detects unexpected encrypted egress traffic from management services (e.g., hostd) or guest VMs utilizing symmetric encryption without traditional protocols (e.g., FTP with embedded AES ciphertext).

  esxi:vmkernel egress log analysis → DC0078 Network Traffic Flow

  esxi:hostd execution + payload hints → DC0064 Command Execution

  NSM:Flow host switch egress data → DC0085 Network Traffic Content

  Tunable: GuestVMExfilWatchlist ServiceEgressProfile

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1048.001

Rules tagged at the parent level (attack.t1048) 12

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.