Forensia CTI Core

About

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.

Platforms: ESXi, Linux, macOS, WindowsMITRE ATT&CK ↗

Software

164 malware/tools implement this

PlugXDyreBACKSPACENETEAGLEADVSTORESHELLDustySkyCallMePsyloMobileOrderMisdatMis-TypeS-TypeZLibCrimsonPteranodonPupyBandookProxysvcBankshotROKRATZebrocyOopsIETrickBotBisonalOctopusCannonKONNIEmpireEmotetAstarothRemexiHOPLIGHTEburyFlawedAmmyynjRATUrsnifHAWKBALLLightNeuronMachetePoetRATHotCroissantImminent MonitorAttorOkrumPowerShowerShimRatReporterLokibotRising SunMetamorfoMechaFlounderSDBbotTajMahalValakGoopyCarberpKesselStrongPityGoldenSpyRDATREvilDrovorubBLINDINGCANKGH_SPYGrandoreiroSLOTHFULMEDIACrutchSparkEVILNUMCaterpillar WebShellAppleJeusPenquinGoldMaxThiefQuestDokiStuxnetIndustroyerSideTwistSombRATAppleSeedGrimAgentSliverSMOKEDHAMQakBotBoxCaonMarkiRATBLUELIGHTXCSSETFoggyWebSysUpdateChrommmeWarzoneRATTomirisCharmPowerTorismaLitePowerCyclops BlinkSILENTTRINITYFlagproMacMaOutSteelSharkKevinDnsSystemIceAppleCreepySnailAmadeyMongallAuTo StealerSquirrelwafflePingPullStrifeWaterSTARWHALEBumblebeeSUGARDUMPFunnyDreamPcSharemetaMainMafaldaSVCReadyWoody RATKOPILUWAKRotaJakiroBADHATCHSharpDiscoNightClubDarkGateMispaduIPsec HelperLunarMailPikabotRaccoon StealerCHIMNEYSWEEPCuckoo StealerManjusakaDUSTTRAPLatrodectusSolarMangoODAgentOilBoosterPowerExchangeShrinkLockerMagicRATStrelaStealerLightSpyLine DancerLine RunnerTroll StealerTRANSLATEXTSagerunexLumma StealerRedLine StealerInvisibleFerretBeaverTailXORIndex LoaderHexEval LoaderHTTPTroyShai-HuludPHASEJAMBRICKSTORMLODEINFOAshTagMuddyViperLAMEHUG

Corpus indicators tagged with this technique

6,064 indicators in the corpus carry T1041.

Indicator	Type	Family	Sev	Src
cve-2026-3102	cve	—	85	3
08060143ea9b55b480746b415af22e3a	hash	ransomware	80	1
fe0161fb8a26a0bf4afad746c7ebf89499dcd3a7	hash	—	80	2
670384fafb23140d96f2f8fe04a13fc8cc8e2a6e5e8c973e39b58d103c5fea92	sha256	phishing	80	1
f6669bd504ce6b0e303be7ee47f2ebbc062989c88c41f0a3f436044a24869798	sha256	supply_chain	80	1
e20b35a8c30e076cdd0e1df05ba1ff2e418dbd39a674f084787cc0af2fda9e95	sha256	phishing	80	1
55d6238b01a177e25eb7d53c943f3abea64ec073	hash	phishing	80	2
164e322d6fbc62e254d73583acd7f39444c884d3f5e6a5d27db143fc25bc88b3	sha256	supply_chain	80	1
3d510977d60a44322f88100b515f06cb5ed83babc64247068d1a489595faa6c5	sha256	phishing	80	1
07cd03e2082bcb0b890cc59ce4c770d1a095ac6f1ae9cf999f5542555c56f841	sha256	phishing	80	1
282b9bc318ad1234cbd1b86424b784299b8be31545802a7c6b751166b814b990	sha256	supply_chain	80	1
17832aa629524ef6e8d8d6e9b6b902a8d324b559e3c36dbd0e221ab1690be871	sha256	supply_chain	80	1
c8075bbff748096e1c6a1ea0aa67bb6762fdd7551427a12425b35b94c1f1ecf2	sha256	supply_chain	80	1
a7bd8869293212e1671df90d2d41b96d4933eb9408b1111bd830e111a91bb202	hash	phishing	80	2
24398b75be2645e6c695e529e62e60deb418143a4bbea13c561d3c361419eb54	hash	—	80	2
7105caa6d4fd8a2c67523d385277528e556ae4f6	hash	—	80	2
82e579bd49d69845133c9aa8585f8bd26736437b	hash	—	80	2
e5e43b0830369c39fab45363486da4d21a98c5097ea262c9816997f11c73c1c4	hash	phishing	80	2
c2eb1033bc01ab0fd732a7ba4967be02c0690bf0	hash	—	80	2
ad10ff9043d6f327045943635fcbd0c5918acb79dc998db92ee4c7dee5224710	sha256	—	80	1
64c7dd0a3a3ae49977ac05913d3878000cce14e5d8c1ee05b782bdfd648bde91	sha256	—	80	1
6c6cbed6aad96564ed87094785be07a1	hash	phishing	80	2
61e9d76f07334843df561fe4bac449fb6fdaed5e5eb91480bded225f3d265c5f	hash	phishing	80	2
c099f965144bccd0b590f946659fc3c0747c54aef505b6caaca9078712f455fb	sha256	—	80	1
d35695f2366a43628231e73ffa83ca106306a8fa	hash	—	80	2
4c9f271242f61f1a31b8146305e9a7ed512c521445d4f7a7a901e301307add3d	sha256	—	80	1
5864a697bd7b339f56b05405f29a097cd027cafdcc4e63c2aaeccccbf930605f	sha256	—	80	1
50ffce607867d8fa8eaf6ef5cd25a3c0e7e4415e881b9e55c04a67bcddb74fdf	sha256	supply_chain	80	1
f96bcd875836da89800912de1e557891697c7cf4	hash	—	80	2
b90988400cced319d260c4937f334ecc364785ed5c593cd2139965e62ca58173	sha256	phishing	80	1

Showing the top 30 by severity of 6,064.