thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Data Exfiltration

The unauthorized transfer of data out of an organization to an attacker-controlled location.

Definition

Exfiltration may occur over C2 channels, cloud storage services, DNS tunneling, email, removable media or physical theft. Attackers often compress and encrypt data and send it in small chunks to evade detection. DLP, egress filtering and monitoring for unusual outbound volume detect it.

Example

An attacker uses rclone to upload 200 GB of file share data to MEGA cloud storage before deploying ransomware.

Exam tip

Large or unusual outbound transfers, especially at odd hours, are the classic exfiltration indicator.

Related terms