Exfiltration Over C2 Channel
Course Content
This course will cover the technique:
> [T1041](https://attack.mitre.org/techniques/T1041/): Exfiltration Over C2 Channel is used by MITRE to describe a tactic that threat actors use to exfiltrate data from a compromised network to a command-and-control (C2) server they control. This technique is often used in advanced persistent threat (APT) attacks, where the attackers seek to maintain persistent access to a network while minimizing their footprint and evading detection.>Exfiltration to C2 typically involves malware that establishes a connection between the compromised system and the attacker's C2 server, allowing the attacker to access and exfiltrate data from the victim network remotely. The malware may use various techniques to conceal its activity and evade detection, such as encrypting its communications, masquerading as legitimate network traffic, or using steganography to hide data within legitimate files.
>Some standard exfiltration methods to C2 include remote access trojans (RATs), backdoors, and command-line interfaces (CLIs) that allow the attacker to interact with the compromised system and issue commands to exfiltrate data.
> Learn how to detect and mitigate these techniques to protect your organization from this type of attack. Apply what you learn and get the hands-on skills you need in Cybrary's MITRE ATT&CK Framework courses aligned to tactics and techniques used by threat actors.
Instructed by
Owen is certified in the GIAC GSEC, CompTIA CySA+, and various other vendor-related certifications. He works both as a technical security engineer and as an SME architect instructor in his spare time. Spreading the word of cyber security is a passion of his. Owen lives in Southeast Michigan with his beautiful wife, daughter, and his dog, Thor. In his free time, Owen enjoys watching sports and movies, and spending time with his family.
Lucas is a seasoned threat researcher in multiple security disciplines, such as real-world adversarial tracking, network vulnerabilities, web exploitation, API abuse, and more. He began his career at the US Department of Defense, where he was trained by some of the world's best operators and analysts. Lucas now operates in the Cybrary red team, emulating real-world threat actors and running purple team exercises. He has 11 industry certifications, including the OSWA, GPEN, GAWN, GCFE, and RHCSA. He is also a member of the GIAC Advisory Board. In his free time, he enjoys working outdoors to improve his farm.
