Esc
File Transfer Protocols - T1071.002

(ATT&CK® Technique)
Definition

Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
D3FEND Inferred Relationships

Browse the D3FEND knowledge graph by clicking on the nodes below.
        graph LR;

     T1071002["File Transfer Protocols"] --> |produces| OutboundInternetFileTransferTraffic["Outbound Internet File Transfer Traffic"]; class T1071002 OffensiveTechniqueNode;
        class OutboundInternetFileTransferTraffic ArtifactNode; click OutboundInternetFileTransferTraffic href "/dao/artifact/d3f:OutboundInternetFileTransferTraffic";
        click T1071002 href "/offensive-technique/attack/T1071.002/"; click OutboundInternetFileTransferTraffic href "/dao/artifact/d3f:OutboundInternetFileTransferTraffic";          T1071002["File Transfer Protocols"] --> |may-transfer| CertificateFile["Certificate File"]; class T1071002 OffensiveTechniqueNode;
        class CertificateFile ArtifactNode; click CertificateFile href "/dao/artifact/d3f:CertificateFile";
        click T1071002 href "/offensive-technique/attack/T1071.002/"; click CertificateFile href "/dao/artifact/d3f:CertificateFile"; T1071002["File Transfer Protocols"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1071002 OffensiveTechniqueNode;
        class OutboundInternetNetworkTraffic ArtifactNode; click OutboundInternetNetworkTraffic href "/dao/artifact/d3f:OutboundInternetNetworkTraffic";
        click T1071002 href "/offensive-technique/attack/T1071.002/"; click OutboundInternetNetworkTraffic href "/dao/artifact/d3f:OutboundInternetNetworkTraffic";    RemoteTerminalSessionDetection["Remote Terminal Session Detection"] -->
          | analyzes | OutboundInternetFileTransferTraffic["Outbound Internet File Transfer Traffic"];

          RemoteTerminalSessionDetection["Remote Terminal Session Detection"] -.->
            | may-detect | T1071002["File Transfer Protocols"] ;
          class RemoteTerminalSessionDetection DefensiveTechniqueNode;
          class OutboundInternetFileTransferTraffic ArtifactNode;
          click RemoteTerminalSessionDetection href "/technique/d3f:RemoteTerminalSessionDetection"; NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] -->
          | analyzes | OutboundInternetFileTransferTraffic["Outbound Internet File Transfer Traffic"];

          NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] -.->
            | may-detect | T1071002["File Transfer Protocols"] ;
          class NetworkTrafficSignatureAnalysis DefensiveTechniqueNode;
          class OutboundInternetFileTransferTraffic ArtifactNode;
          click NetworkTrafficSignatureAnalysis href "/technique/d3f:NetworkTrafficSignatureAnalysis"; Client-serverPayloadProfiling["Client-server Payload Profiling"] -->
          | analyzes | OutboundInternetFileTransferTraffic["Outbound Internet File Transfer Traffic"];

          Client-serverPayloadProfiling["Client-server Payload Profiling"] -.->
            | may-detect | T1071002["File Transfer Protocols"] ;
          class Client-serverPayloadProfiling DefensiveTechniqueNode;
          class OutboundInternetFileTransferTraffic ArtifactNode;
          click Client-serverPayloadProfiling href "/technique/d3f:Client-serverPayloadProfiling"; RelayPatternAnalysis["Relay Pattern Analysis"] -->
          | analyzes | OutboundInternetFileTransferTraffic["Outbound Internet File Transfer Traffic"];

          RelayPatternAnalysis["Relay Pattern Analysis"] -.->
            | may-detect | T1071002["File Transfer Protocols"] ;
          class RelayPatternAnalysis DefensiveTechniqueNode;
          class OutboundInternetFileTransferTraffic ArtifactNode;
          click RelayPatternAnalysis href "/technique/d3f:RelayPatternAnalysis"; NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] -->
          | analyzes | OutboundInternetFileTransferTraffic["Outbound Internet File Transfer Traffic"];

          NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] -.->
            | may-detect | T1071002["File Transfer Protocols"] ;
          class NetworkTrafficCommunityDeviation DefensiveTechniqueNode;
          class OutboundInternetFileTransferTraffic ArtifactNode;
          click NetworkTrafficCommunityDeviation href "/technique/d3f:NetworkTrafficCommunityDeviation";                                            RemoteTerminalSessionDetection["Remote Terminal Session Detection"] -->
          | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"];

          
          class RemoteTerminalSessionDetection DefensiveTechniqueNode;
          class OutboundInternetNetworkTraffic ArtifactNode;
          click RemoteTerminalSessionDetection href "/technique/d3f:RemoteTerminalSessionDetection";  NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] -->
          | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"];

          
          class NetworkTrafficSignatureAnalysis DefensiveTechniqueNode;
          class OutboundInternetNetworkTraffic ArtifactNode;
          click NetworkTrafficSignatureAnalysis href "/technique/d3f:NetworkTrafficSignatureAnalysis"; CertificateAnalysis["Certificate Analysis"] -->
          | analyzes | CertificateFile["Certificate File"];

          CertificateAnalysis["Certificate Analysis"] -.->
            | may-detect | T1071002["File Transfer Protocols"] ;
          class CertificateAnalysis DefensiveTechniqueNode;
          class CertificateFile ArtifactNode;
          click CertificateAnalysis href "/technique/d3f:CertificateAnalysis";  Client-serverPayloadProfiling["Client-server Payload Profiling"] -->
          | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"];

          
          class Client-serverPayloadProfiling DefensiveTechniqueNode;
          class OutboundInternetNetworkTraffic ArtifactNode;
          click Client-serverPayloadProfiling href "/technique/d3f:Client-serverPayloadProfiling"; RelayPatternAnalysis["Relay Pattern Analysis"] -->
          | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"];

          
          class RelayPatternAnalysis DefensiveTechniqueNode;
          class OutboundInternetNetworkTraffic ArtifactNode;
          click RelayPatternAnalysis href "/technique/d3f:RelayPatternAnalysis";  NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] -->
          | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"];

          
          class NetworkTrafficCommunityDeviation DefensiveTechniqueNode;
          class OutboundInternetNetworkTraffic ArtifactNode;
          click NetworkTrafficCommunityDeviation href "/technique/d3f:NetworkTrafficCommunityDeviation";             ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] -->
          | analyzes | OutboundInternetFileTransferTraffic["Outbound Internet File Transfer Traffic"];

          ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] -.->
            | may-detect | T1071002["File Transfer Protocols"] ;
          class ProtocolMetadataAnomalyDetection DefensiveTechniqueNode;
          class OutboundInternetFileTransferTraffic ArtifactNode;
          click ProtocolMetadataAnomalyDetection href "/technique/d3f:ProtocolMetadataAnomalyDetection";    PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] -->
          | analyzes | OutboundInternetFileTransferTraffic["Outbound Internet File Transfer Traffic"];

          PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] -.->
            | may-detect | T1071002["File Transfer Protocols"] ;
          class PerHostDownload-UploadRatioAnalysis DefensiveTechniqueNode;
          class OutboundInternetFileTransferTraffic ArtifactNode;
          click PerHostDownload-UploadRatioAnalysis href "/technique/d3f:PerHostDownload-UploadRatioAnalysis";                ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] -->
          | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"];

          
          class ProtocolMetadataAnomalyDetection DefensiveTechniqueNode;
          class OutboundInternetNetworkTraffic ArtifactNode;
          click ProtocolMetadataAnomalyDetection href "/technique/d3f:ProtocolMetadataAnomalyDetection";          PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] -->
          | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"];

          
          class PerHostDownload-UploadRatioAnalysis DefensiveTechniqueNode;
          class OutboundInternetNetworkTraffic ArtifactNode;
          click PerHostDownload-UploadRatioAnalysis href "/technique/d3f:PerHostDownload-UploadRatioAnalysis";     FileCarving["File Carving"] -->
          | analyzes | OutboundInternetFileTransferTraffic["Outbound Internet File Transfer Traffic"];

          FileCarving["File Carving"] -.->
            | may-detect | T1071002["File Transfer Protocols"] ;
          class FileCarving DefensiveTechniqueNode;
          class OutboundInternetFileTransferTraffic ArtifactNode;
          click FileCarving href "/technique/d3f:FileCarving";                UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] -->
          | analyzes | OutboundInternetFileTransferTraffic["Outbound Internet File Transfer Traffic"];

          UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] -.->
            | may-detect | T1071002["File Transfer Protocols"] ;
          class UserGeolocationLogonPatternAnalysis DefensiveTechniqueNode;
          class OutboundInternetFileTransferTraffic ArtifactNode;
          click UserGeolocationLogonPatternAnalysis href "/technique/d3f:UserGeolocationLogonPatternAnalysis";           UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] -->
          | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"];

          
          class UserGeolocationLogonPatternAnalysis DefensiveTechniqueNode;
          class OutboundInternetNetworkTraffic ArtifactNode;
          click UserGeolocationLogonPatternAnalysis href "/technique/d3f:UserGeolocationLogonPatternAnalysis";    OutboundTrafficFiltering["Outbound Traffic Filtering"] -->
          | filters | OutboundInternetFileTransferTraffic["Outbound Internet File Transfer Traffic"];

          OutboundTrafficFiltering["Outbound Traffic Filtering"] -.->
            | may-isolate | T1071002["File Transfer Protocols"] ;
          class OutboundTrafficFiltering DefensiveTechniqueNode;
          class OutboundInternetFileTransferTraffic ArtifactNode;
          click OutboundTrafficFiltering href "/technique/d3f:OutboundTrafficFiltering";          OutboundTrafficFiltering["Outbound Traffic Filtering"] -->
          | filters | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"];

          
          class OutboundTrafficFiltering DefensiveTechniqueNode;
          class OutboundInternetNetworkTraffic ArtifactNode;
          click OutboundTrafficFiltering href "/technique/d3f:OutboundTrafficFiltering";  RemoteFileAccessMediation["Remote File Access Mediation"] -->
          | isolates | CertificateFile["Certificate File"];

          RemoteFileAccessMediation["Remote File Access Mediation"] -.->
            | may-isolate | T1071002["File Transfer Protocols"] ;
          class RemoteFileAccessMediation DefensiveTechniqueNode;
          class CertificateFile ArtifactNode;
          click RemoteFileAccessMediation href "/technique/d3f:RemoteFileAccessMediation";    DecoyFile["Decoy File"] -->
          | spoofs | CertificateFile["Certificate File"];

          DecoyFile["Decoy File"] -.->
            | may-deceive | T1071002["File Transfer Protocols"] ;
          class DecoyFile DefensiveTechniqueNode;
          class CertificateFile ArtifactNode;
          click DecoyFile href "/technique/d3f:DecoyFile"; NetworkTrafficFiltering["Network Traffic Filtering"] -->
          | filters | OutboundInternetFileTransferTraffic["Outbound Internet File Transfer Traffic"];

          NetworkTrafficFiltering["Network Traffic Filtering"] -.->
            | may-isolate | T1071002["File Transfer Protocols"] ;
          class NetworkTrafficFiltering DefensiveTechniqueNode;
          class OutboundInternetFileTransferTraffic ArtifactNode;
          click NetworkTrafficFiltering href "/technique/d3f:NetworkTrafficFiltering";          NetworkTrafficFiltering["Network Traffic Filtering"] -->
          | filters | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"];

          
          class NetworkTrafficFiltering DefensiveTechniqueNode;
          class OutboundInternetNetworkTraffic ArtifactNode;
          click NetworkTrafficFiltering href "/technique/d3f:NetworkTrafficFiltering";  LocalFilePermissions["Local File Permissions"] -->
          | restricts | CertificateFile["Certificate File"];

          LocalFilePermissions["Local File Permissions"] -.->
            | may-isolate | T1071002["File Transfer Protocols"] ;
          class LocalFilePermissions DefensiveTechniqueNode;
          class CertificateFile ArtifactNode;
          click LocalFilePermissions href "/technique/d3f:LocalFilePermissions"; RestoreFile["Restore File"] -->
          | restores | CertificateFile["Certificate File"];

          RestoreFile["Restore File"] -.->
            | may-restore | T1071002["File Transfer Protocols"] ;
          class RestoreFile DefensiveTechniqueNode;
          class CertificateFile ArtifactNode;
          click RestoreFile href "/technique/d3f:RestoreFile"; FileAnalysis["File Analysis"] -->
          | analyzes | CertificateFile["Certificate File"];

          FileAnalysis["File Analysis"] -.->
            | may-detect | T1071002["File Transfer Protocols"] ;
          class FileAnalysis DefensiveTechniqueNode;
          class CertificateFile ArtifactNode;
          click FileAnalysis href "/technique/d3f:FileAnalysis";    FileIntegrityMonitoring["File Integrity Monitoring"] -->
          | analyzes | CertificateFile["Certificate File"];

          FileIntegrityMonitoring["File Integrity Monitoring"] -.->
            | may-detect | T1071002["File Transfer Protocols"] ;
          class FileIntegrityMonitoring DefensiveTechniqueNode;
          class CertificateFile ArtifactNode;
          click FileIntegrityMonitoring href "/technique/d3f:FileIntegrityMonitoring"; FileEviction["File Eviction"] -->
          | deletes | CertificateFile["Certificate File"];

          FileEviction["File Eviction"] -.->
            | may-evict | T1071002["File Transfer Protocols"] ;
          class FileEviction DefensiveTechniqueNode;
          class CertificateFile ArtifactNode;
          click FileEviction href "/technique/d3f:FileEviction"; FileEncryption["File Encryption"] -->
          | encrypts | CertificateFile["Certificate File"];

          FileEncryption["File Encryption"] -.->
            | may-harden | T1071002["File Transfer Protocols"] ;
          class FileEncryption DefensiveTechniqueNode;
          class CertificateFile ArtifactNode;
          click FileEncryption href "/technique/d3f:FileEncryption";
json