Data Exfiltration: How Data Quietly Walks Out the Door

The 30-second explanation

Once attackers have found something valuable, they still have to get it out. That movement leaves traces, which is often the last chance to notice the theft.

How it works

1. 1

   1. Find

   Locate valuable files or databases.

2. 2

   2. Stage

   Collect and compress them in one place.

3. 3

   3. Send

   Upload to an external destination.

4. 4

   4. Cover

   Delete traces or blend into normal traffic.

The typical steps are to find the data, gather it in one place, compress or encrypt it, and then send it out. The route might be an upload to a cloud service, a connection to the attacker's server, or tunnelling data inside other traffic. Each step changes what the network and endpoints see. Defenders watch for large outbound transfers, unusual destinations, archive creation and tools that should not be present.

Real-world example

How to spot it

• Volume spikes

  Outbound traffic far above the normal baseline.

• New destinations

  First-time connections to unfamiliar services.

• Archive files created

  Large compressed files appearing on servers.

• Transfers at odd times

  Bursts overnight or on weekends.

What to do

1. 1Establish normal outbound patterns so anomalies are visible.
2. 2Restrict which systems can reach the internet and which services they can upload to.
3. 3Classify sensitive data and add extra monitoring where it lives.