Skip to content
The Incident Ledger

Data exfiltration

noun · also Exfiltration · MITRE ATT&CK TA0010

The unauthorized transfer of data out of an organization, often the attacker's main goal or the leverage behind a ransomware extortion.

Exfiltration is the moment data leaves your control. MITRE ATT&CK treats it as a tactic (TA0010) with several common methods: sending data over the same channel the attacker uses for command and control (T1041), uploading it to cloud storage services (T1567.002), or moving it over protocols such as FTP or DNS that are less closely watched. Attackers usually collect and compress data first, sometimes encrypting the archive so its contents cannot be inspected on the way out.

Exfiltration is central to modern ransomware: groups copy data before encrypting it, so they can threaten to publish it even if the victim restores from backups.

Example

Over a weekend, a file server sends 300 GB to a cloud storage provider the organization does not use. The upload is done with rclone, a legitimate file synchronization tool, launched from an administrator account that normally only signs in during business hours. Two days later, the ransomware is deployed.

Why it matters for a SOC analyst

Exfiltration is often detectable before the damage is done, if you look at volume and destination: unusually large outbound transfers, uploads to unsanctioned cloud services, archiving tools run on servers, and data leaving at odd hours. When it is confirmed, the incident usually becomes a potential data breach, with legal and notification consequences that need to be escalated quickly.

Articles that use this term

Related terms

  • Data loss prevention

    Controls that detect and block sensitive data, such as card numbers or confidential files, from leaving the organization through email, uploads or devices.

  • Ransomware

    Malware that encrypts an organization's data and demands payment for the key, often after stealing the data to threaten its release.

  • Command and control

    The channel attackers use to communicate with compromised systems: sending commands, receiving stolen data and delivering new tools.

  • Data breach

    A confirmed incident in which protected data, such as personal or confidential information, was accessed, disclosed or stolen without authorization.