Techniques › T1048 › T1048.002

T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

exfiltration — ESXi, Linux, macOS, Windows · attack.mitre.org · JSON

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

• DET0512 Detection of Exfiltration Over Asymmetric Encrypted Non-C2 Protocol v1.0
  AN1413 Windows

  Detects non-browser processes that establish encrypted outbound connections (e.g., TLS/SSL) to unfamiliar or atypical destinations for the host/user, following a data staging or compression event.

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Security EventCode=4663, 4670, 4656 → DC0055 File Access

  NSM:Flow ssl.log - Certificate Analysis → DC0085 Network Traffic Content

  Tunable: TimeWindow CertificateIssuerDenylist BinaryAllowlist
  AN1414 Linux

  Detects staged file access (e.g., archive or obfuscation), followed by an encrypted outbound connection (TLS/HTTPS) from unusual processes such as curl/wget, Python scripts, or custom binaries.

  auditd:SYSCALL execve → DC0032 Process Creation

  auditd:SYSCALL connect → DC0082 Network Connection Creation

  NSM:Flow ssl.log, conn.log → DC0085 Network Traffic Content

  auditd:SYSCALL open, read → DC0055 File Access

  Tunable: ConnectionDestinationScope FileAccessExtensionList SSLClientProcessBaseline
  AN1415 macOS

  Detects abnormal encrypted network connections (via TLS/HTTPS) initiated by non-browser binaries, particularly after sensitive file access or compression events.

  macos:osquery socket_events → DC0078 Network Traffic Flow

  macos:osquery process_events → DC0032 Process Creation

  macos:unifiedlog log stream - file provider subsystem → DC0055 File Access

  NSM:Flow ssl.log, x509.log → DC0085 Network Traffic Content

  Tunable: OutboundTrafficVolumeThreshold FileSensitivityContext
  AN1416 ESXi

  Detects unexpected encrypted outbound connections from management components or guest VMs using TLS, particularly after data volume spikes or script-based orchestration from within guest environments.

  esxi:hostd event stream → DC0064 Command Execution

  esxi:vmkernel egress logs → DC0078 Network Traffic Flow

  Tunable: VMToEgressPathWatchlist TLSClientAppIdentifier

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1048.002

Rules tagged at the parent level (attack.t1048) 12

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.