What is Exfiltration?

Before data leaves the network, attackers stage it: they crawl file shares and databases for high-value content, pull it into a single working directory, and often compress or password-protect the archive to reduce its size and obscure its contents from content inspection. Some groups split large archives into smaller chunks to stay under alerting thresholds on any single transfer.

Exfiltration channels are chosen to blend with normal traffic. HTTPS uploads to consumer cloud storage (Dropbox, Google Drive, MEGA, personal OneDrive tenants) work well because these domains are usually allow-listed at the firewall and the traffic looks like ordinary SaaS usage. DNS tunneling encodes stolen data as base64 strings inside subdomain labels and sends it through a series of DNS queries, a channel that survives in almost every network because DNS is rarely fully inspected. Attackers also abuse legitimate remote-access and file-transfer tools already present in the environment (rclone, WinSCP, curl to a webhook), a living-off-the-land approach that avoids dropping new binaries an EDR might flag. Slower operators use email to personal accounts or physical media (USB) when network egress is tightly controlled.

Detection relies on layered signals rather than a single indicator. DLP inspects outbound content for classification tags, regex patterns (credit card numbers, SSNs), or fingerprinted documents, and can block or quarantine matching transfers. Network monitoring flags unusually large or sustained outbound transfers, first-time connections from a host to cloud storage, and abnormal DNS query volume or entropy to a single external domain. UEBA baselines how much data each user or service account normally touches and alerts when that volume spikes, catching cases where the exfiltrated data isn't sensitive by DLP classification but the access pattern itself is anomalous.

Timing compounds the difficulty of catching exfiltration. Attackers frequently stage the transfer for off-hours or weekend windows when fewer analysts are on shift and baseline network traffic is lower, so a large transfer stands out less in raw volume but also gets less scrutiny in the moment. Groups running an active command-and-control channel sometimes exfiltrate incrementally over that same channel rather than as one large event, trading speed for stealth, which is why C2 detection and exfiltration detection often overlap rather than being separate problems in practice.