What MITRE ATT&CK Mobile T1639: Exfiltration Over Alternative Protocol (Mobile Tactic TA0036 - Exfiltration) requires
MITRE ATT&CK T1639 (Exfiltration Over Alternative Protocol) is an ATT&CK for Mobile Exfiltration technique. Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Different protocol channels could also include Web services such as cloud storage. ATT&CK documents 1 sub-technique: T1639.001 Exfiltration Over Unencrypted Non-C2 Protocol. Affected platforms: Android, iOS. Mobile controls map to NIST SP 800-124 Rev 2 and OWASP MASVS.
Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:
Primary source: https://attack.mitre.org/techniques/T1639/
SHA-256 integrity: 262b1fac46b700ea98900747ce6392ed8f4e27a0cedb2fbbbe9d46ae896ad86b
Primary Citations — 5 traced to source
- MITRE ATT&CK for Mobile Technique T1639: Exfiltration Over Alternative Protocol (https://attack.mitre.org/techniques/T1639/) with 1 sub-techniques
- MITRE ATT&CK Mobile Tactic TA0036: Exfiltration (https://attack.mitre.org/tactics/TA0036/)
+ 3 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
- Discovery (free): /api/v1/nodes/mitre-attack-mobile-t1639-exfiltration-over-alternative-protocol.json — 6-field metadata
- Vault (full node): /api/v1/vault/nodes/mitre-attack-mobile-t1639-exfiltration-over-alternative-protocol.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
- Canonical URL: https://bidda.com/intelligence/mitre-attack-mobile-t1639-exfiltration-over-alternative-protocol
- Back to registry: Browse all 10,085 compliance nodes