Exfiltration Over Alternative Protocol and Clear CLI History

Financially motivated adversaries will often steal valuable data and exfiltrate it over an alternate protocol like FTP, SMTP or, HTTP/S. They could also encrypt or obfuscate these alternate channels to protect their nefarious activities. Learn to exfiltrate the attackers by detecting and mitigating these techniques.

Course Content

Detection, Validation, and Mitigation (Lab)


Exfiltration over Alternative Protocol and Clear CLI History
What is Clear Command Line History?


Exfiltration over Alternative Protocol and Clear CLI History
What is Exfiltration over Alternative Protocol?


Exfiltration over Alternative Protocol and Clear CLI History
Course Description

Organizations that don't have proper data loss prevention or network intrusion detection/prevention mechanisms in place could fall victim to attackers who use the Exfiltration over Alternative Protocol technique. Threat actors have been known to use this method to exfiltrate data to a URL, via UDP, or even over an email account, for example. There are numerous ways threat actors can use alternative protocols for nefarious means to steal data and put it where they can get to it later.

You will be in a better position to protect your organization from attackers who might want to steal valuable data once you learn how to detect and mitigate this activity.

Get the hands-on skills you need to detect and mitigate this attack in Cybrary's MITRE ATT&CK Framework courses aligned to the tactics and techniques used by the financially motivated threat group Prophet Spider. Prevent adversaries from accomplishing the tactic of Exfiltration in your environment today.

This course is part of a Career Path:
No items found.

Instructed by

Master Instructor
Matthew Mullins

Matt has led multiple Red Team engagements, ranging from a few weeks to a year and covering multiple security domains. Outside of Red Teaming, Matt is also a seasoned penetration tester with interests in: AppSec, OSINT, Hardware, Wifi, Social Engineering, and Physical Security. Matt has a Master's degree in Information Assurance and an exhaustive number of certifications ranging from frameworks, management, and hands-on hacking. Matt is a Technical SME at Cybrary, focusing on Adversarial Emulation and Red Teaming for course content.

Chris Daywalt

After too many years of security operations work, Chris Daywalt tries to turn his phone off at 5:00 pm EST. While there are a bunch of training classes and education somewhere on his resume, much of what he has to teach was learned at the school of hard knocks, often at the expense of his previous clients. He wants to help you spend more time detecting and denying adversaries and less time banging your head against your keyboard. He dips his blueberry donuts in orange juice.

Chris’ 19-year career includes work for organizations of all sizes, both government and private sector, and is distributed roughly like so:

  • 30% doing DFIR
  • 30% teaching DFIR
  • 20% monitoring and detection engineering
  • 15% risk assessment
  • 5% other stuff, like sneaking in a game of Plants vs. Zombies or taking a quick nap at the desk (Don’t judge - I work overtime)

    Cybrary Logo
    Certification Body
    Certificate of Completion

    Complete this entire course to earn a Exfiltration Over Alternative Protocol and Clear CLI History Certificate of Completion