Exfiltration: techniques, detection & defense

Exfiltration refers to the unauthorized transfer of data from a compromised system or network to an attacker-controlled destination. In cybersecurity, exfiltration is the final and most critical phase of many intrusions. Attackers use exfiltration to extract credentials, intellectual property, PII, or strategic documents. The techniques vary widely: direct transfer over C2 channels, DNS tunneling (encoding data inside DNS queries), HTTPS exfiltration blending into legitimate traffic, or physical media. MITRE ATT&CK maps this under tactic TA0010, with techniques such as T1041 (Exfiltration Over C2 Channel), T1048 (Exfiltration Over Alternative Protocol), and T1567 (Exfiltration Over Web Service). Attackers often compress and encrypt payloads before sending them to reduce detection surface. They may also throttle transfer speed to stay below anomaly thresholds. Understanding the exfiltration mechanism is essential for defenders building effective data loss prevention strategies and network monitoring baselines.

Detecting exfiltration requires correlation across multiple data sources. On the network side, monitor for unusually large outbound transfers, unexpected destinations, or traffic on non-standard ports. DNS-based exfiltration produces abnormally long query names, high query frequency to a single domain, or rare TLDs. Tools like Zeek, Suricata, and Elastic SIEM can flag these patterns. On endpoints, Windows Event ID 4663 (file object access) and Sysmon Event ID 11 (file creation) help track large file staging. Sysmon Event ID 3 reveals unexpected outbound connections from non-browser processes. DLP solutions can detect sensitive document transfers in real time. Netflow analysis is critical: baseline normal egress volumes per host, then alert on deviations beyond two standard deviations. Proxy logs should be reviewed for high-volume POST requests or base64-encoded payloads in URL parameters. User and Entity Behavior Analytics (UEBA) can correlate off-hours access with subsequent data movement. Hunting for PowerShell invoking WebClient or Invoke-WebRequest toward external IPs is also a high-fidelity detection signal.

Red teams simulate exfiltration to validate detection coverage and DLP configurations. Common tools include DNScat2 for DNS tunneling, Egress-Assess for testing data loss controls, and Cobalt Strike's built-in exfiltration modules. Attackers frequently stage data in writable directories such as C:/Windows/Temp or C:/ProgramData before exfiltrating. PowerShell one-liners using System.Net.WebClient or curl can push archives to paste sites or cloud storage like OneDrive and Dropbox, leveraging trusted domains to evade proxy filters. To harden against exfiltration, enforce strict egress firewall rules allowing only approved destinations and protocols. Implement TLS inspection on outbound HTTPS to break encrypted covert channels. Deploy application-layer DLP that inspects content, not just metadata. Restrict DNS resolution to internal resolvers and block direct external DNS queries. Rate-limit outbound DNS at the resolver level to disrupt tunneling. Segment sensitive data environments with micro-segmentation so lateral movement does not directly reach egress paths. Finally, validate controls periodically with purple team exercises that replay real exfiltration TTPs from ATT&CK TA0010.