Data Exfiltration

What is data exfiltration?

Data exfiltration is the unauthorized transfer of data out of a system or network by an attacker. It usually follows a quiet sequence: find the data, stage it in one place, compress it, then send it out. Staging leaves the most host-side evidence, which makes it the practical place to catch an exfiltration in progress.

If you already knew that, the useful question is the next one: would your own environment show you anything while it happened? That depends less on what exfiltration is than on where in the attacker's sequence you look.

One precision first. The standards definition contains no attacker. NIST's glossary records exfiltration as "the unauthorized transfer of information from a system," and CNSSI 4009-2015 words it almost identically.

The intent arrives from a different document. In MITRE ATT&CK, Exfiltration is a named adversary tactic, TA0010, with its own technique set. That is why leakage and exfiltration are different words.

Explain It Like I'm 10

Think of an office where someone has already got in and now wants to leave with the files. They do not walk out room by room with an armful of paper. They spend an afternoon quietly carrying things into one empty storeroom, box everything up, and only then walk out the front door with a single box that looks like every other box leaving the building. The carrying and the boxing make noise inside. The walk out the front door does not.

Exfiltration, data leakage, and a data breach: what is the difference?

Four words cover overlapping situations. The difference turns on whether data actually moved out, and whether an adversary meant it to.

The first row is the one that carries weight in an investigation, because the standards wording turns on transfer. Staged archives with no evidence that anything left is a real finding, and a different one, usually made while disclosure timelines are running.

What are the stages of data exfiltration?

Exfiltration is the last step of a sequence, not a moment. Treat the pattern below as common rather than universal, because real intrusions skip steps and improvise. The shape rarely changes: data has to be found before it can be gathered, and gathered before it can be moved.

Staging is the step that leaves evidence

MITRE tracks staging as its own technique, T1074 Data Staged: adversaries stage collected data in a central location before exfiltration, locally or on a remote system they control. It leaves evidence because it is work done on machines you own. ATT&CK publishes detection analytics for exactly this, covering staging of sensitive files into temporary or public directories, compression with 7zip or WinRAR, or batch copy prior to exfiltration.

Those analytics need process and file telemetry. Where it is not collected, the artifacts still occur and nothing records them. There is something here to hunt, which is not the same as saying staging reliably gets caught.

The documented case is a joint CISA and FBI advisory on Scattered Spider. Where the goal was data theft, the actors installed extract, transform and load tools to bring data from multiple sources into one centralized database before exfiltration, recorded in the advisory's own table as Data Staged, T1074.

Compression and encryption come first

MITRE gives both motives under T1560: compression obfuscates the collected data and minimizes what crosses the network, encryption hides it from inspection. So if payload inspection at the perimeter finds nothing useful, that is often because a utility made the data unreadable one step earlier, on a host.

How do you detect data exfiltration? Channel by channel

There is no single exfiltration signal, because the channel decides what the evidence is and where it lives. No percentage appears here for the most common channel either, because no measured breakdown by channel exists in the sources this page cites. The ranking that matters locally is which of these your telemetry would record at all:

• The existing C2 channel: endpoint telemetry, joined to network records.
• An alternative protocol, including DNS: DNS resolver logs.
• Cloud storage and web services: proxy, CASB and cloud audit logs.
• SaaS platforms: the platform's own audit log, and nowhere else.
• Email, under T1114: mail platform audit logs.
• Removable media under T1052, other network media under T1011, and the insider: endpoint telemetry and DLP.

The channel that is already open

The cheapest option is the connection the attacker already has. Under T1041, stolen data is encoded into the normal communications channel using the same protocol as the command and control traffic, so watching for a new outbound connection finds nothing here.

What shows up instead is a sequence. ATT&CK's detection strategy names processes that read sensitive files and then immediately open unusual outbound sessions with encrypted or binary payloads. File access first, then the connection. How well the command-and-control channel blends in decides how visible any of that is, which makes it a subject worth understanding on its own.

A different protocol than the C2 channel

Exfiltration can also ride a protocol other than the C2 channel, which MITRE tracks as T1048. DNS is the best-documented case: ATT&CK records the NightClub malware adding data to the subdomain portion of DNS requests, and TXT, NULL and CNAME records are the ones most often abused, because they hold arbitrary text.

Kaspersky's ProjectSauron analysis shows the tradeoff in one line, describing a DNS exfiltration tool run deliberately in low-bandwidth mode to stay under generic tunnel detection, which is why it moved only system metadata. DNS tunneling is a large enough subject to be worth reading about separately.

Sanctioned cloud, web services and SaaS

T1567.002 covers exfiltration to a cloud storage service rather than the primary C2 channel. MITRE's named destinations include Dropbox, Google Drive, OneDrive, MEGA, Amazon S3 and Snowflake, with procedure entries for Akira using Rclone, APT41's DUST reaching OneDrive, and Storm-0501 using Rclone and AzCopy. Destination reputation is not a usable control when the services are legitimate.

The tooling is equally ordinary. ReliaQuest put Rclone in 57% of the incidents it examined between September 2023 and July 2024, ahead of WinSCP and cURL. Read that as the tool that kept turning up in that dataset rather than a current rate; all three are programs administrators install on purpose.

SaaS carries its own signature. CISA and the FBI record Scattered Spider finding a target's Snowflake access and running thousands of queries immediately, then exfiltrating to sites including MEGA and US data centers. Query volume is the signal there, not traffic volume, and it lives in an audit log no network sensor reads.

Why the transfer stage is the worst place to look

Nearly every guide on this subject recommends watching for a spike in outbound traffic. It is reasonable advice and the weakest signal in the set, for three separate reasons.

• Chunking: under T1030, an adversary may exfiltrate in fixed size chunks or limit packet sizes below certain thresholds to avoid triggering network data transfer threshold alerts. Note the precision: that defeats thresholds, not all volume analysis.
• Encoding inside a channel that is already open: there is no volume anomaly when the session was already normal for that host, and the contents were compressed and encrypted before they moved.
• Destinations that are legitimate by design: a large upload to a cloud provider the business already uses does not look like exfiltration to any control keyed on reputation.

All three share one shape. The further a signal sits from the host, the less it tells you. On the host, collection and archiving are unusual acts by identifiable processes. On the wire, the same activity is an ordinary session to an ordinary destination, at a size somebody chose.

What the measured data actually says

Two kinds of evidence show up here. Breach-and-attack simulation measures what controls do against simulated attacks run in production; incident response measures what happened in real intrusions. Blending them produces a number that means nothing.

The simulation side supplies the sharpest figure on the page. In the Picus Blue Report 2026, organizations logged 58% of simulated attacks but generated alerts for only 14% of them, fewer than one in seven. The evidence is being written down. It is not being surfaced.

Unit 42's 2026 incident-response reporting describes the same gap from the other direction: "In many engagements, the signals were there... the evidence is in the logs. But during the attack, teams had to stitch together data from multiple disconnected sources, slowing detection during the most critical early minutes."

Name the report edition, every time

Two Picus figures circulate on this subject and they come from different datasets. Search results conflate them.

The 2026 edition does not restate the 3%. If a page quotes both in one breath, it has merged two studies.

The clock you are actually racing

Three numbers get quoted about exfiltration speed, and none means anything without its scope.

• CrowdStrike's 2026 Global Threat Report puts the average eCrime breakout time at 29 minutes in 2025, fastest observed 27 seconds. Breakout is the lateral-movement clock, not the exfiltration one.
• Unit 42 measured 72 minutes from initial access to data exfiltration in the fastest cases across more than 750 investigated incidents. A fastest case, not a median.
• CrowdStrike also reports one intrusion where exfiltration began within four minutes of initial access. A single anecdote, and nothing should be planned around it as typical.

No source here publishes an average time to exfiltration. How long an intruder stays before anyone notices is a separate measurement with its own literature.

When theft is the entire attack

The old model puts exfiltration inside a ransomware attack, as the step before encryption. CISA and the FBI record Scattered Spider exfiltrating data and threatening to release it without deploying ransomware at all.

Verizon's 2026 Data Breach Investigations Report, built on incident data rather than a vendor's product telemetry, describes the same behavior: actors "simply rely on extortion alone and do not trigger the encryption of data." Unit 42 measured encryption-based extortion falling 15% year over year. When the leverage is the copy rather than the lock, restoring from backup does not end the incident.

Where this argument stops

The case above is easy to over-read, so here are its limits.

• Prevention is not broken. The same Blue Report 2026 dataset also records prevention effectiveness recovering to 69% overall, its 2024 peak, endpoint prevention at 83%, and privilege escalation prevention up 24 points to 79%, the largest tactic-level gain of the year. The failure is specific to quiet post-compromise activity.
• The one-in-ten figure measures blocking, not visibility. It says how often quiet collection actions were stopped, not how often they were seen. The staging argument here rests on published host-side analytics plus a telemetry precondition, which is narrower than "staging gets caught."
• Chunking limits thresholds, not volume analysis. Volume remains a signal. It just fires last.

So expect real but bounded work from the controls most teams already own. Data loss prevention and least privilege cut what a compromised account can reach and catch the obvious paths out. The three mechanisms above are precisely what they do not resolve, and the insider with legitimate access is a fourth.

The same gap explains why blocklists age badly. The utilities that turn up in real exfiltration are file-sync and transfer tools administrators install deliberately, so what separates an attack from an afternoon of legitimate work is the behavior around the tool rather than the tool. Which indicator you choose to detect on, and how expensive it is for the attacker to change it, is a decision with its own framework behind it.

Common questions about data exfiltration

What is the 1-10-60 rule, and is it still the benchmark? It is CrowdStrike's older framing: detect in one minute, investigate in ten, contain in sixty. Treat it as one vendor's target rather than an industry standard. The same vendor's current reporting leads with breakout time instead, so the metric its own research emphasizes has moved.

What is data exfiltration in AI? The documented case is EchoLeak, CVE-2025-32711, a zero-click flaw in Microsoft 365 Copilot rated CVSS 9.3 and found by Aim Security. Microsoft describes it as AI command injection allowing an unauthorized attacker to disclose information over a network, with data leaking out through Teams and SharePoint URLs and no user interaction. It was patched server-side in June 2025, with no known exploitation in the wild.

We found staged archives but no evidence of transfer. Was that exfiltration? On the standards wording, no: the definition turns on unauthorized transfer, and staged archives are collection. That is not a reason to relax, because no evidence of transfer is not evidence of no transfer. It usually means the telemetry that would show one needs checking before anyone signs off.

What to go check

The sequence is the map. The catchable moment sits upstream of the transfer, on hosts you already own, and the stage everyone watches is the one your controls stop least.

Four places, in your own environment:

1. Bulk file reads followed by an archive utility running on the same host.
2. One host reading from many sources it does not normally touch.
3. Outbound sessions from processes that do not normally talk to the network.
4. Cloud and SaaS audit logs, for query bursts and bulk downloads.

Then the half the measured data points at: for each, find out whether it produces an alert or only a log line. Recording something and noticing it are different capabilities.

One last detail from the same CISA and FBI advisory, because it changes how the checking gets done. The actors searched the target organization's email to see whether the intrusion had been detected and a response started. If you find something, coordinate the response somewhere the intruder is not already reading.

Look earlier than the transfer, and make sure that looking sets off something louder than a log line.