Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

ATT&CK index / stage 14 of 15

Exfiltration

Data leaving. The question the business will ask first and the hardest one to answer honestly.

Techniques
199 parent
With mitigations
1844 listed
Detection strategies
19from ATT&CK analytics

If this is live right now

Stop reading the matrix and work the playbook. The reference below is for afterwards, when you are deciding what to change.

The techniques

open one for mitigations and detection
T1011Exfiltration Over Other Network Medium2 mitigations1 sub-techniqueAdversaries may attempt to exfiltrate data over a different network medium than the command and control channel. If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel.

Platforms: Linux, macOS, Windows

What reduces it

  • M1028 Operating System Configuration. Prevent the creation of new network adapters where possible.
  • M1042 Disable or Remove Feature or Program. Disable WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel in local computer security settings or by group policy if it is not needed within an environment.

How to see it

  • Detection of Exfiltration Over Alternate Network Interfaces

    • Execution of file transfer or network access activity through non-primary interfaces (e.g., WiFi, Bluetooth, cellular) by processes not typically associated with such behavior (e.g., rundll32, powershell, regsvr32).
    • Use of `rfkill`, `nmcli`, or low-level tools (e.g., `iw`, `hcitool`, `pppd`) to enable alternate interfaces followed by data transfer via non-primary NICs.
    • AppleScript or system calls to activate WiFi/Bluetooth interfaces (`networksetup`, `blueutil`), followed by exfiltration via AirDrop, cloud sync, or network socket.

Sub-techniques

  • T1011.001 Exfiltration Over Bluetooth. Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel. Adversaries may choose to do this if they have sufficient access and proximity.

The T1011 page →T1011 on attack.mitre.org

T1020Automated Exfiltration1 sub-techniqueAdversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection. When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over C2 Channel and Exfiltration Over Alternative Protocol.

Platforms: Linux, macOS, Network Devices, Windows

How to see it

  • Automated Exfiltration Detection Strategy

    • Detection of automated tools or scripts periodically transmitting data to external destinations using scheduled tasks or background processes.
    • Background scripts (e.g., via cron) or daemons transmitting data repeatedly to remote IPs or URLs.
    • Observation of LaunchAgents or LaunchDaemons establishing periodic external connections indicative of automated data transfer.

Sub-techniques

  • T1020.001 Traffic Duplication. Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure. Traffic mirroring is a native feature for some devices, often used for network analysis. For example, devices may be configured to forward network traffic to one or more destinations for analysis by a network analyzer or other monitoring device.

The T1020 page →T1020 on attack.mitre.org

T1029Scheduled Transfer1 mitigationAdversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals. This could be done to blend traffic patterns with normal activity or availability. When scheduled exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over C2 Channel or Exfiltration Over Alternative Protocol.

Platforms: Linux, macOS, Windows

What reduces it

  • M1031 Network Intrusion Prevention. Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary command and control infrastructure and malware can be used to mitigate activity at the network level.

How to see it

  • Detection Strategy for Scheduled Transfer and Recurrent Exfiltration Patterns

    • Recurring network exfiltration initiated by scheduled or script-based processes exhibiting time-based regularity and consistent external destinations.
    • Detection of cron-based or script-based recurring transfers where the same script, user, or destination reappears at predictable intervals.
    • LaunchAgent or launchd recurring jobs initiating data transfer to consistent external IPs or domains with repeat timing signatures.

The T1029 page →T1029 on attack.mitre.org

T1030Data Transfer Size Limits1 mitigationAn adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.

Platforms: Linux, macOS, Windows, ESXi

What reduces it

  • M1031 Network Intrusion Prevention. Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary command and control infrastructure and malware can be used to mitigate activity at the network level.

How to see it

  • Detection Strategy for Data Transfer Size Limits and Chunked Exfiltration

    • Adversary uses a process to establish outbound connections that transmit uniform packet sizes at a consistent interval, avoiding threshold-based network alerts.
    • Outbound connections from non-network-facing processes repeatedly send similarly sized payloads within uniform time intervals.
    • Processes on macOS initiate external connections that consistently transmit data in fixed sizes using LaunchAgents or unexpected users.

The T1030 page →T1030 on attack.mitre.org

T1041Exfiltration Over C2 Channel4 on this site2 mitigationsAdversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.

Platforms: ESXi, Linux, macOS, Windows

What reduces it

  • M1031 Network Intrusion Prevention. Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions.
  • M1057 Data Loss Prevention. Data loss prevention can detect and block sensitive data being sent over unencrypted protocols.

How to see it

  • Detection Strategy for Exfiltration Over C2 Channel

    • Identifies suspicious outbound traffic volume mismatches from processes that typically do not generate network activity, particularly over C2 protocols like HTTPS, DNS, or custom TCP/UDP ports, following file or data access.
    • Monitors for processes reading sensitive files then immediately initiating unusual outbound connections or bulk transfer sessions over persistent sockets, particularly with encrypted or binary payloads.
    • Detects unauthorized applications or scripts accessing sensitive data followed by establishing encrypted outbound communication to rare external destinations or with abnormal byte ratios.
    • Detects VMs sending outbound traffic through non-standard services or to unknown destinations. Exfiltration over reverse shells tunneled via VMkernel or custom payloads routed via hostd/vpxa.

Everything on this site for T1041 →T1041 on attack.mitre.org

T1048Exfiltration Over Alternative Protocol7 on this site6 mitigations3 sub-techniquesAdversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Adversaries may also opt to encrypt and/or obfuscate these alternate channels.

Platforms: ESXi, IaaS, Linux, macOS, Network Devices, Office Suite, SaaS, Windows

What reduces it

  • M1031 Network Intrusion Prevention. Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary command and control infrastructure and malware can be used to mitigate activity at the network level.
  • M1037 Filter Network Traffic. Enforce proxies and use dedicated servers for services such as DNS and only allow those systems to communicate over respective ports/protocols, instead of all systems within a network. Cloud service providers support IP-based restrictions when accessing cloud resources.
  • M1057 Data Loss Prevention. Data loss prevention can detect and block sensitive data being uploaded via web browsers.
  • M1030 Network Segmentation. Follow best practices for network firewall configurations to allow only necessary ports and traffic to enter and exit the network.
  • M1018 User Account Management. Configure user permissions groups and roles for access to cloud storage. Implement strict Identity and Access Management (IAM) controls to prevent access to storage solutions except for the applications, users, and services that require access.
  • M1022 Restrict File and Directory Permissions. Use access control lists on cloud storage systems and objects.

How to see it

  • Behavioral Detection Strategy for Exfiltration Over Alternative Protocol

    • Detects unusual outbound file transfer behavior using protocols like FTP, SMB, SMTP, or DNS, involving non-standard processes, off-hour activity, or uncommonly high volume.
    • Detects file exfiltration using tools like curl, scp, or custom binaries over protocols such as FTP, HTTP/S, or DNS tunneling, especially outside baseline user behavior.
    • Detects non-native file transfer via curl, Python scripts, or AppleScript using uncommon protocols like FTP, SMTP, or DNS exfiltration through mDNSResponder abuse.
    • Detects access to cloud APIs or CLI tools to move or sync files from sensitive buckets to external endpoints using protocols like HTTPS or S3 APIs.

Sub-techniques

  • T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol. Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Symmetric encryption algorithms are those that use shared or the same keys/secrets on each end of the channel.
  • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol. Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Asymmetric encryption algorithms are those that use different keys on each end of the channel.
  • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol · 3 on this site. Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Adversaries may opt to obfuscate this data, without the use of encryption, within network protocols that are natively unencrypted (such as HTTP, FTP, or DNS).

Everything on this site for T1048 →T1048 on attack.mitre.org

T1052Exfiltration Over Physical Medium3 on this site3 mitigations1 sub-techniqueAdversaries may attempt to exfiltrate data via a physical medium, such as a removable drive. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device.

Platforms: Linux, macOS, Windows

What reduces it

  • M1034 Limit Hardware Installation. Limit the use of USB devices and removable media within a network.
  • M1057 Data Loss Prevention. Data loss prevention can detect and block sensitive data being copied to physical mediums.
  • M1042 Disable or Remove Feature or Program. Disable Autorun if it is unnecessary. Disallow or restrict removable media at an organizational policy level if they are not required for business operations.

How to see it

  • Detection of Data Exfiltration via Removable Media

    • Detects removable drive insertion followed by unusual file access, compression, or staging activity by unauthorized users or unexpected processes.
    • Detects mounted external devices (via /media or /mnt) followed by large file read or copy operations by shell scripts, unauthorized users, or staging tools (e.g., tar, rsync).
    • Detects mounting of external volumes followed by high-volume or sensitive file access via Finder, terminal, or third-party apps (e.g., rsync, zip).

Sub-techniques

  • T1052.001 Exfiltration over USB · 3 on this site. Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.

Everything on this site for T1052 →T1052 on attack.mitre.org

T1537Transfer Data to Cloud Account4 mitigationsAdversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service. A defender who is monitoring for large transfers to outside the cloud environment through normal file transfers or over command and control channels may not be watching for data transfers to another account within the same cloud provider.

Platforms: IaaS, Office Suite, SaaS

What reduces it

  • M1037 Filter Network Traffic. Implement network-based filtering restrictions to prohibit data transfers to untrusted VPCs.
  • M1057 Data Loss Prevention. Data loss prevention can prevent and block sensitive data from being shared with individuals outside an organization.
  • M1018 User Account Management. Limit user account and IAM policies to the least privileges required.
  • M1054 Software Configuration. Configure appropriate data sharing restrictions in cloud services. For example, external sharing in Microsoft SharePoint and Google Drive can be turned off altogether, blocked for certain domains, or restricted to certain users.

How to see it

  • Cross-Platform Detection of Data Transfer to Cloud Account

    • Detects snapshot sharing, backup exports, or data object transfers from victim-owned cloud accounts to other cloud identities within the same provider (e.g., AWS, Azure) using snapshot sharing, S3 bucket policy updates, or SAS URI generation.
    • Detects user activity that shares or syncs files with external domains via link generation, OneDrive external sharing, or file transfer actions involving non-whitelisted partner tenants.
    • Detects use of built-in SaaS sharing mechanisms to transfer ownership or share access of critical data to external tenants or untrusted users through API calls or link generation features.

The T1537 page →T1537 on attack.mitre.org

T1567Exfiltration Over Web Service9 on this site2 mitigations4 sub-techniquesAdversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services.

Platforms: ESXi, Linux, macOS, Office Suite, SaaS, Windows

What reduces it

  • M1021 Restrict Web-Based Content. Web proxies can be used to enforce an external network communication policy that prevents use of unauthorized external services.
  • M1057 Data Loss Prevention. Data loss prevention can be detect and block sensitive data being uploaded to web services via web browsers.

How to see it

  • Detection Strategy for Exfiltration Over Web Service

    • Processes that normally do not initiate network communications suddenly making outbound HTTPS connections with high outbound-to-inbound data ratios. Defender view: correlation between process creation logs (e.g., Word, Excel, PowerShell) and subsequent anomalous network traffic volumes toward common web services...
    • Processes (tar, curl, python scripts) accessing large file sets and initiating outbound HTTPS POST requests with payload sizes inconsistent with baseline activity. Defender perspective: detect abnormal sequence of file archival followed by encrypted uploads to external web services.
    • Office apps or scripts writing files followed by xattr manipulation (to evade quarantine) and subsequent HTTPS uploads. Defender perspective: anomalous file modification + outbound TLS traffic originating from non-networking apps (Word, Excel, Preview).
    • Abnormal API calls from user accounts invoking file upload endpoints outside normal baselines (M365, Google Drive, Box). Defender perspective: monitor unified audit logs for elevated frequency of Upload, Create, or Copy operations from compromised accounts.

Sub-techniques

  • T1567.001 Exfiltration to Code Repository. Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection.
  • T1567.002 Exfiltration to Cloud Storage · 5 on this site. Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet. Examples of cloud storage services include Dropbox and Google Docs.
  • T1567.003 Exfiltration to Text Storage Sites. Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel. Text storage sites, such as `pastebin[.]com`, are commonly used by developers to share code and other information. Text storage sites are often used to host malicious code for C2 communication (e.g., Stage Capabilities), but adversaries may also use these sites to exfiltrate collected data.
  • T1567.004 Exfiltration Over Webhook. Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel. Webhooks are simple mechanisms for allowing a server to push data over HTTP/S to a client without the need for the client to continuously poll the server.

Everything on this site for T1567 →T1567 on attack.mitre.org

Technique descriptions, mitigations and detection analytics on this page are reproduced from MITRE ATT&CK, ATT&CK version 19.2, retrieved 2026-09-12. ATT&CK is a registered trademark of The MITRE Corporation and is used here under its terms of use. The playbooks, and the sentence describing what this stage means for a responder, are ours.