value:  CookieMiner has used the curl --upload-file command to exfiltrate data over HTTP. ;; CORALDECK has exfiltrated data in HTTP POST headers. ;; CosmicDuke exfiltrates collected files over FTP or WebDAV. Exfiltration servers can be separately configured from C2 servers. ;; FIN6 has sent stolen payment card data to remote servers via HTTP POSTs. ;; FIN8 has used FTP to exfiltrate collected data. ;; FTP may be used to exfiltrate data separate from the main command and control protocol. ;; Kessel can exfiltrate credentials and other information via HTTP POST request TCP and DNS. ;; KONNI has used FTP to exfiltrate reconnaissance data out. ;; Lazarus Group malware SierraBravo-Two generates an email message via SMTP containing information about newly infected victims. ;; OilRig has exfiltrated data over FTP separately from its primary C2 channel over DNS. ;; PoetRAT has used FTP for exfiltration. ;; Remsec can exfiltrate data via a DNS tunnel or email separately from its C2 channel. ;; Thrip has used WinSCP to exfiltrate data from a targeted organization over FTP. ;; WindTail has the ability to automatically exfiltrate files using the macOS built-in utility /usr/bin/curl. ;; Wizard Spider has exfiltrated victim information using FTP.
name: Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non