EXT-10 Extraction · Exfiltration & C2 KQL No YARA

Multi-Channel Redundant Exfiltration

Multi-Channel Redundant Exfiltration refers to the coordinated use of multiple independent communication or transfer mechanisms to ensure reliable data extraction from a target environment..

Mappings

MITRE ATT&CK

T1008 Fallback Channels T1104 Multi-Stage Channels

CVE examples

Not vulnerability-based — this capability is behavioural.

MalwareBazaar

AgentTesla

Summary

Multi-Channel Redundant Exfiltration refers to the coordinated use of multiple independent communication or transfer mechanisms to ensure reliable data extraction from a target environment. This includes simultaneously transmitting the same data through different network protocols, storage services, or communication platforms to prevent disruption or detection from blocking the operation. Within MalChain, this capability begins once attacker-controlled processes establish more than one active path for transferring sensitive information outside the environment. Attackers exploit implicit trust in diverse communication infrastructure and distributed data transfer workflows to maintain operational resilience against defensive controls. Routine reliance on multiple communication and storage technologies often allows redundant transfers to occur without immediate correlation across monitoring systems. Trust abuse may involve sending identical data through web services, cloud storage, and messaging platforms concurrently, or automatically switching transfer channels when one path becomes unavailable. Common exfiltration methods include:

Sending the same data through multiple network protocols
Using backup communication channels for data transfer
Automatically switching transfer methods when blocked
Synchronizing data across multiple external storage locations
Combining network and physical transfer mechanisms

Real world usage includes:

Advanced intrusion campaigns ensuring successful data theft despite network controls
Ransomware operations maintaining redundant communication channels
Insider threat scenarios using multiple transfer methods to avoid detection
Persistent threats maintaining resilience against defensive disruption

Detection Guidance

Detection relies on monitoring concurrent data transfer activity, communication diversity, and system behavior associated with coordinated exfiltration attempts. Contextual correlation between multiple transfer mechanisms is essential to reduce false positives.

Monitor simultaneous outbound data transfers across different channels
Detect repeated transmission of identical files to multiple destinations
Correlate network and storage activity involving the same data sources
Alert on rapid switching between communication methods
Identify rare or unauthorized multi-channel transfer patterns

KQL Detection Concepts

Network and cloud activity indicating concurrent data transfer sessions
Repeated file transfer events targeting multiple external destinations
Correlated data movement across different communication protocols

YARA Detection Concepts

Scripts or binaries implementing multi-channel communication routines
Code patterns coordinating multiple transfer mechanisms
Executable components managing redundant data transmission

KQL Detection Rule

kql

// Multi-Channel Redundant Exfil: one process using several distinct egress channels
DeviceNetworkEvents
| where Timestamp > ago(1d) and RemoteIPType == "Public"
| summarize Channels=dcount(RemoteUrl), Protocols=make_set(RemotePort,10) by DeviceName, InitiatingProcessFileName, bin(Timestamp,30m)
| where Channels > 15
| project Timestamp, DeviceName, InitiatingProcessFileName, Channels, Protocols

YARA Detection Rule

YARA is not meaningfully applicable to this primarily behavioral / network-telemetry capability. Rely on the KQL rule above plus network and identity detections.