Exfiltration Over C2 Channel

This course will cover the technique:

T1041: Exfiltration Over C2 Channel is used by MITRE to describe a tactic that threat actors use to exfiltrate data from a compromised network to a command-and-control (C2) server they control. This technique is often used in advanced persistent threat (APT) attacks, where the attackers seek to maintain persistent access to a network while minimizing their footprint and evading detection.

Exfiltration to C2 typically involves malware that establishes a connection between the compromised system and the attacker's C2 server, allowing the attacker to access and exfiltrate data from the victim network remotely. The malware may use various techniques to conceal its activity and evade detection, such as encrypting its communications, masquerading as legitimate network traffic, or using steganography to hide data within legitimate files.

Some standard exfiltration methods to C2 include remote access trojans (RATs), backdoors, and command-line interfaces (CLIs) that allow the attacker to interact with the compromised system and issue commands to exfiltrate data.

Learn how to detect and mitigate these techniques to protect your organization from this type of attack. Apply what you learn and get the hands-on skills you need in Cybrary's MITRE ATT&CK Framework courses aligned to tactics and techniques used by threat actors.