Exfiltration Over Alternative Protocol

What is Exfiltration Over Alternative Protocol?

“Exfiltration Over Alternative Protocol is documented as technique T1048 in MITRE ATT&CK® v19.1 under the Exfiltration tactic. Detection requires visibility into Firewall, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Exfiltration Over Alternative Protocol activity. These methods apply across Firewall, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor for outbound FTP, SFTP, and SCP connections from systems that do not have legitimate reasons to transfer files to external destinations, particularly connections to IP ranges associated with commercial hosting.

2. 2

   Alert on large volumes of data sent via email to external addresses, particularly compressed or encrypted attachments, using email DLP policies and monitoring for attachments exceeding size thresholds.

3. 3

   Detect DNS-based exfiltration through analysis of DNS query volumes, subdomain entropy, and total DNS data volume per endpoint, as DNS exfiltration generates characteristic statistical signatures.

4. 4

   Monitor cloud storage API usage for bulk uploads to personal accounts or unapproved cloud services, including OneDrive, Dropbox, Google Drive, and Mega from corporate endpoints.

5. 5

   Implement egress filtering to block unauthorized use of alternative protocols for data transfer, combined with monitoring of allowed protocols for volume anomalies that may indicate data theft.

Example Alerts

These realistic alert examples show what Exfiltration Over Alternative Protocol looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Exfiltration Over Alternative Protocol?

Detection centers on Firewall, SIEM telemetry for the exfiltration phase of the attack. Monitor for outbound FTP, SFTP, and SCP connections from systems that do not have legitimate reasons to transfer files to external destinations, particularly connections to IP ranges associated with commercial hosting. Alert on large volumes of data sent via email to external addresses, particularly compressed or encrypted attachments, using email DLP policies and monitoring for attachments exceeding size thresholds.

What does a Exfiltration Over Alternative Protocol alert look like?

A representative Firewall detection is "Large Data Upload to Personal Cloud Storage" (high severity): Proxy logs detected 23GB uploaded to dropbox.com from workstation WS-HR-019 over 4 hours using a personal Dropbox account not affiliated with the company. The upload contains compressed archives of files collected from corporate network shares. The volume and file sources do not match any legitimate business use case. Corporate policy prohibits uploading company data to personal cloud storage accounts.

Which tools detect Exfiltration Over Alternative Protocol, and how can I practice?

Exfiltration Over Alternative Protocol (T1048) is best surfaced with Firewall, SIEM telemetry, which exposes the exfiltration signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.