Exfiltration Over Alternative Protocol
Exfiltration over an alternative protocol transfers collected data through a route separate from the main control channel.
What it means
Exfiltration over an alternative protocol transfers collected data through a route separate from the main control channel. Different protocols may have different monitoring coverage.
An investigation example
A compromised server stages reports locally, then sends them through an unexpected outbound mail or file-transfer path.
Evidence to examine
Review protocol usage, process ownership, destination accounts, transfer size, and staging timestamps.
A common analytical pitfall
Blocking the observed command channel does not necessarily block a separate data-transfer path.
Response considerations
Investigate all supported outbound paths and apply evidence-based containment while preserving the distinction between command activity and exfiltration.
Export can use a path distinct from control
An intruder may use one communication mechanism for coordination and another for moving collected information. The alternative protocol is relevant because a defender focused only on the known control path could miss the export. Describe the observed protocols and endpoints precisely rather than assume that all traffic from the affected host serves the same function.
Different applications legitimately use several protocols, so variety alone is not suspicious. Investigators need to connect collection, packaging, initiating process, destination, and transfer outcome. An outbound conversation on a less familiar protocol does not automatically prove that restricted data was sent.
A fictional separate export connection
An academy identifies unauthorized control activity over one channel. Later, an associated process accesses an archive and establishes a different outbound connection. Analysts correlate endpoint and network records and examine whether the destination and transfer are approved. They preserve the chain without claiming archive contents solely from timing or volume.
Encryption, compression, and protocol overhead can limit byte-for-byte comparison. State what the evidence demonstrates about successful movement and what remains inferred. A blocked request may show attempted export without proving completed data loss. The distinction is important to exposure assessment and business communication.
Trace two communication roles
Draw a fictional host with a control connection and a separate data-transfer path. Mark the evidence available for each and identify the point where the archive is linked to the outbound traffic. Write one conclusion supported by the records and one that would require additional content evidence. Use prepared logs, not real sensitive files.
Containment should consider the broader host and identity context. Blocking the control destination may not stop a separately scheduled or automated export. Verify all observed paths through the incident plan and investigate the authority that allowed the data to be accessed in the first place.
Related concepts
References & further reading
Original explanations, with primary references for deeper study.
MITRE ATT&CK T1048: Exfiltration Over Alternative Protocol