ATT&CK Reference
Portfolio

STEP 13 OF 14 · TA0010

Exfiltration

Move the collected data out of the network.

The data leaves — over the existing C2 channel, to a cloud storage account, onto a USB device, or through a legitimate file transfer service that your users also use every day for real work.

Why it matters on shift

Exfiltration is the point at which a security incident becomes a breach with legal reporting obligations. Egress volume baselines per host are cheap and catch most of it.

9 techniques

Techniques & detection

  1. T1011

    Exfiltration Over Other Network Medium

    Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel.

    Detect it with
    Monitor for processes utilizing the network that do not normally have network communication or have never been seen before.

    1 sub-techniques

  2. T1020

    Automated Exfiltration

    Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.

    Detect it with
    Monitor process file access patterns and network behavior. Unrecognized processes or scripts that appear to be traversing file systems and sending network traffic may be suspicious.

    1 sub-techniques

  3. T1029

    Scheduled Transfer

    Exfiltration timed to blend into backup windows or normal business traffic patterns.

    Detect it with
    Recurring outbound transfers at fixed offsets; egress that continues on weekends when users are absent.

  4. T1030

    Data Transfer Size Limits

    An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.

    Detect it with
    Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server).

  5. T1041

    Exfiltration Over C2 Channel

    Data sent out through the same channel already used for control.

    Detect it with
    Upload volume far exceeding download on a long-lived session; sustained outbound to a single rare host.

  6. T1048

    Exfiltration Over Alternative Protocol

    DNS tunnelling, FTP, and ICMP used to carry data around web-focused controls.

    Detect it with
    Abnormal DNS TXT query volume and length; internal hosts sending FTP outbound at all.

    3 sub-techniques

  7. T1052

    Exfiltration Over Physical Medium

    USB drives and other removable media used where the network is monitored.

    Detect it with
    Removable device insertion events (Event ID 6416) followed by bulk file copies.

    1 sub-techniques

  8. T1537

    Transfer Data to Cloud Account

    Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service.

    Detect it with
    Monitor account activity for attempts to share data, snapshots, or backups with untrusted or unusual accounts on the same cloud service provider. Monitor for anomalous file transfer activity between accounts and to untrusted VPCs.

  9. T1567

    Exfiltration Over Web Service

    Dropbox, Google Drive, Mega, Discord, and pastebin-style services used as drop points.

    Detect it with
    Large uploads to personal cloud storage from servers; DLP policies on unsanctioned storage domains.

    4 sub-techniques