T1041 — Exfiltration Over C2 Channel

# T1041 - Exfiltration Over C2 Channel

## SOC Recommendation
Investigate Exfiltration Over C2 Channel activity in the context of Exfiltration: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| File Analysis | Detect | Monitor for File Analysis indicators relevant to this technique. |
| File Encryption | Harden | Apply File Encryption to reduce this technique's viability before an incident occurs. |
| File Eviction | Evict | Use File Eviction to remove the adversary's foothold once this technique is confirmed. |
| Content Filtering | Isolate | Apply Content Filtering to contain the blast radius once this technique is observed. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Block C2 IP/domain at firewall immediately | Medium | No | Yes |
| Isolate the device | Medium | No | Yes |
| Identify what data was in the exfiltrated payload (memory fo | Low | No | Yes |
| Assess breach notification obligations | Low | No | Yes |

## KQL
```kql
let BeaconingHosts = (
    CommonSecurityLog
    | where TimeGenerated >= ago(2h)
    | where DeviceAction !in ("deny", "block", "drop")
    | where DestinationIP !startswith "10." and DestinationIP !startswith "192.168."
    | summarize AvgBytes = avg(SentBytes), StdDev = stdev(SentBytes), ConnCount = count() by SourceIP, DestinationIP
    | where ConnCount >= 5 and StdDev <= 30
);
CommonSecurityLog
| where TimeGenerated >= ago(15m)
| where DeviceAction !in ("deny", "block", "drop")
| where DestinationIP !startswith "10." and DestinationIP !startswith "192.168."
| summarize RecentBytes = sum(SentBytes) by SourceIP, DestinationIP, DeviceName
| join kind=inner BeaconingHosts on SourceIP, DestinationIP
| where RecentBytes > (AvgBytes + 10 * StdDev)
| where RecentBytes > 1000000
| extend timestamp = now(), HostCustomEntity = DeviceName, IPCustomEntity = DestinationIP
| order by RecentBytes desc
```
```kql
let runningRAT_parameters = dynamic(['/ui/chk', 'mactok=', 'UsRnMe=', 'IlocalP=', 'kMnD=']);
CommonSecurityLog
| where RequestMethod == "GET"
| project TimeGenerated, DeviceVendor, DeviceProduct, DeviceAction, DestinationDnsDomain, DestinationIP, RequestURL, SourceIP, SourceHostName, RequestClientApplication
| where RequestURL has_any (runningRAT_parameters)
```
```kql
let TimeWindow   = 90d;    // How far back to look 
let HitThreshold = 10;     // Minimum hits to alert per SourceIp + Category
let MinSeverity  = 1;      // Set Minimum Severity
let EnableCategoryFilter    = true;   // Filter 1: use CategoriesOfInterest
let EnableDescriptionFilter = false;  // Filter 2: use DescriptionsOfInterest
let EnableActionFilter      = false;  // Filter 3: use MatchActions
let CategoriesOfInterest    = dynamic([
    "Targeted Malicious Activity was Detected",
    "Exploit Kit Activity Detected",
    "Domain Observed Used for C2 Detected",
    "Successful Credential Theft Detected",
    "Malware Command and Control Activity Detected",
    "Executable code was detected",
    "A Network Trojan was detected"
]);
let DescriptionsOfInterest  = dynamic([
    "targeted-activity",
    "exploit-kit",
    "domain-c2",
    "credential-theft",
    "command-and-control",
    "shellcode-detect",
    "trojan-activity"
]);
let MatchActions = dynamic(["Deny", "alert"]);
AZFWIdpsSignature
| where TimeGenerated >= ago(TimeWindow)
| where Severity >= MinSeverity
// Filter 1: Category filter (optional)
| where (EnableCategoryFilter == false) or (Category has_any (CategoriesOfInterest))
// Filter 2: Description filter (optional)
| where (EnableDescriptionFilter == false) or (Description has_any (DescriptionsOfInterest))
// Filter 3: Action filter (optional)
| where (EnableActionFilter == false) or (Action in~ (MatchActions))
| summarize
    StartTime   = min(TimeGenerated),
    EndTime     = max(TimeGenerated),
    TotalHits   = count(),
    MaxSeverity = max(Severity),
    Actions     = make_set(Action, 5),
    Signatures  = make_set(SignatureId, 20),
    Description = make_set(substring(tostring(Description), 0, 120), 3)
    by SourceIp, ThreatCategory = Category
| where TotalHits >= HitThreshold
| project
    StartTime,
    EndTime,
    SourceIp,
    ThreatCategory,
    TotalHits,
    MaxSeverity,
    Actions,
    Signatures,
    Description
| order by MaxSeverity desc, TotalHits desc
```

## Escalation Criteria
- Exfiltration Over C2 Channel activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1041.json
• /api/recommendations/T1041.json
• /api/d3fend/T1041.json
• /api/mappings/T1041.json
• /api/confluence/T1041.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1041.json

Response:

{
  "technique_id": "T1041",
  "name": "Exfiltration Over C2 Channel",
  "priority": "high",
  "status": "complete",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Exfiltration"
  ],
  "platforms": [
    "ESXi",
    "Linux",
    "macOS",
    "Windows"
  ],
  "summary": "Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.",
  "soc_recommendation": "Investigate Exfiltration Over C2 Channel activity in the context of Exfiltration: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-FA",
      "name": "File Analysis",
      "relationship": "detect",
      "practical_action": "Monitor for File Analysis indicators relevant to this technique.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FE",
      "name": "File Encryption",
      "relationship": "harden",
      "practical_action": "Apply File Encryption to reduce this technique's viability before an incident occurs.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FEV",
      "name": "File Eviction",
      "relationship": "evict",
      "practical_action": "Use File Eviction to remove the adversary's foothold once this technique is confirmed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-CF",
      "name": "Content Filtering",
      "relationship": "isolate",
      "practical_action": "Apply Content Filtering to contain the blast radius once this technique is observed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.",
      "Check Sentinel analytics rules and incidents correlated with this technique.",
      "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource."
    ],
    "generic": [
      "Confirm whether the observed exfiltration over c2 channel activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"Data Exfiltration Over C2 Channel\" -- Flags a host with an established C2-beaconing connection pattern suddenly sending a large volume of outbound data through that same channel. Requires firewall byte-count telemetry (CommonSecurityLog)."
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Block C2 IP/domain at firewall immediately",
      "category": "Response",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Isolate the device",
      "category": "Response",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Identify what data was in the exfiltrated payload (memory fo",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Identify what data was in the exfiltrated payload (memory forensics)"
    },
    {
      "name": "Assess breach notification obligations",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "GEN-EF-002 — Data Exfiltration Over C2 Channel",
        "description": "Flags a host with an established C2-beaconing connection pattern suddenly sending a large volume of outbound data through that same channel. Requires firewall byte-count telemetry (CommonSecurityLog). (Source: Bell Integration baseline detection library.)",
        "query": "let BeaconingHosts = (\n    CommonSecurityLog\n    | where TimeGenerated >= ago(2h)\n    | where DeviceAction !in (\"deny\", \"block\", \"drop\")\n    | where DestinationIP !startswith \"10.\" and DestinationIP !startswith \"192.168.\"\n    | summarize AvgBytes = avg(SentBytes), StdDev = stdev(SentBytes), ConnCount = count() by SourceIP, DestinationIP\n    | where ConnCount >= 5 and StdDev <= 30\n);\nCommonSecurityLog\n| where TimeGenerated >= ago(15m)\n| where DeviceAction !in (\"deny\", \"block\", \"drop\")\n| where DestinationIP !startswith \"10.\" and DestinationIP !startswith \"192.168.\"\n| summarize RecentBytes = sum(SentBytes) by SourceIP, DestinationIP, DeviceName\n| join kind=inner BeaconingHosts on SourceIP, DestinationIP\n| where RecentBytes > (AvgBytes + 10 * StdDev)\n| where RecentBytes > 1000000\n| extend timestamp = now(), HostCustomEntity = DeviceName, IPCustomEntity = DestinationIP\n| order by RecentBytes desc"
      },
      {
        "name": "baedfdf4-7cc8-45a1-81a9-065821628b83 — RunningRAT request parameters",
        "description": "This detection will alert when RunningRAT URI parameters or paths are detect in an HTTP request. Id the device blocked this communication presence of this alert means the RunningRAT implant is likely still executing on the source host.' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "let runningRAT_parameters = dynamic(['/ui/chk', 'mactok=', 'UsRnMe=', 'IlocalP=', 'kMnD=']);\nCommonSecurityLog\n| where RequestMethod == \"GET\"\n| project TimeGenerated, DeviceVendor, DeviceProduct, DeviceAction, DestinationDnsDomain, DestinationIP, RequestURL, SourceIP, SourceHostName, RequestClientApplication\n| where RequestURL has_any (runningRAT_parameters)"
      },
      {
        "name": "504257c1-81e2-4609-8d40-b395e62f11c7 — High severity malicious activity detected",
        "description": "Identifies high severity malicious activity in Azure Firewall IDPS logs. (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "let TimeWindow   = 90d;    // How far back to look \nlet HitThreshold = 10;     // Minimum hits to alert per SourceIp + Category\nlet MinSeverity  = 1;      // Set Minimum Severity\nlet EnableCategoryFilter    = true;   // Filter 1: use CategoriesOfInterest\nlet EnableDescriptionFilter = false;  // Filter 2: use DescriptionsOfInterest\nlet EnableActionFilter      = false;  // Filter 3: use MatchActions\nlet CategoriesOfInterest    = dynamic([\n    \"Targeted Malicious Activity was Detected\",\n    \"Exploit Kit Activity Detected\",\n    \"Domain Observed Used for C2 Detected\",\n    \"Successful Credential Theft Detected\",\n    \"Malware Command and Control Activity Detected\",\n    \"Executable code was detected\",\n    \"A Network Trojan was detected\"\n]);\nlet DescriptionsOfInterest  = dynamic([\n    \"targeted-activity\",\n    \"exploit-kit\",\n    \"domain-c2\",\n    \"credential-theft\",\n    \"command-and-control\",\n    \"shellcode-detect\",\n    \"trojan-activity\"\n]);\nlet MatchActions = dynamic([\"Deny\", \"alert\"]);\nAZFWIdpsSignature\n| where TimeGenerated >= ago(TimeWindow)\n| where Severity >= MinSeverity\n// Filter 1: Category filter (optional)\n| where (EnableCategoryFilter == false) or (Category has_any (CategoriesOfInterest))\n// Filter 2: Description filter (optional)\n| where (EnableDescriptionFilter == false) or (Description has_any (DescriptionsOfInterest))\n// Filter 3: Action filter (optional)\n| where (EnableActionFilter == false) or (Action in~ (MatchActions))\n| summarize\n    StartTime   = min(TimeGenerated),\n    EndTime     = max(TimeGenerated),\n    TotalHits   = count(),\n    MaxSeverity = max(Severity),\n    Actions     = make_set(Action, 5),\n    Signatures  = make_set(SignatureId, 20),\n    Description = make_set(substring(tostring(Description), 0, 120), 3)\n    by SourceIp, ThreatCategory = Category\n| where TotalHits >= HitThreshold\n| project\n    StartTime,\n    EndTime,\n    SourceIp,\n    ThreatCategory,\n    TotalHits,\n    MaxSeverity,\n    Actions,\n    Signatures,\n    Description\n| order by MaxSeverity desc, TotalHits desc"
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "25d917c4-aa3c-4111-974c-286c0312ff95 — Network Activity Detected via Kworker",
        "description": "(KUERY) This rule monitors for network connections from a kworker process. kworker, or kernel worker, processes are part of the kernel's workqueue mechanism. They are responsible for executing work that has been scheduled to be done in kernel space, which might include tasks like handling interrupts, background activities, and other kernel-related tasks... (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "host.os.type:linux and event.category:network and event.action:(connection_attempted or connection_accepted) and\nprocess.name:kworker* and not destination.ip:(\n  10.0.0.0/8 or\n  127.0.0.0/8 or\n  169.254.0.0/16 or\n  172.16.0.0/12 or\n  192.168.0.0/16 or\n  224.0.0.0/4 or\n  \"::1\" or\n  \"FE80::/10\" or\n  \"FF00::/8\" or\n  \"0.0.0.0\"\n) and not destination.port:(\"2049\" or \"111\" or \"892\" or \"597\")"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Exfiltration Over C2 Channel activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate administrative or maintenance activity matching this pattern.",
    "Approved security testing or red team exercise.",
    "Known benign software producing similar telemetry."
  ],
  "confluence": {
    "title": "T1041 - Exfiltration Over C2 Channel Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}