Exfiltration Over C2 Channel

T1041 'Exfiltration Over C2 Channel' is the ATT&CK exfiltration-tactic technique for siphoning data over the legitimate command-and-control channel; SPARTA EXF-0007 covers compromised-ground-system exfiltration where the GS's legitimate data-distribution paths (telemetry forwarders, archive databases, cross-site links) are the C2-equivalent channel. Tactic and activity align directly.

MITRE Enterprise has no impact-tactic data-theft technique; the theft outcome is captured through the exfiltration mechanism (T1041 Exfiltration Over C2 Channel and related). T1041 covers data theft via the legitimate C2 channel — the primary mechanism for SPARTA IMP-0006 'Theft' (steal mission-critical data via spacecraft downlink). Cross-tactic moderate (exfiltration vs impact) honors MITRE's separation of exfil-mechanism from impact-outcome where SPARTA combines them.