Skip to content
TheCloud.Events

Exfiltration

Exfiltration

Section titled “Exfiltration”

The adversary is trying to steal data.

Exfiltration consists of techniques that adversaries may use to steal data from your network. Once they’ve collected data, adversaries often package it to avoid detection while removing it. This can include compression and encryption. Techniques for getting data out of a target network typically include transferring it over their command and control channel or an alternate channel and may also include putting size limits on the transmission.

In cloud environments, adversaries exfiltrate data by sharing snapshots or AMIs with external accounts, copying data to attacker-controlled storage buckets, or transferring resources across regions. They may also abuse cloud-native data transfer services or modify bucket policies to allow public access.

View Exfiltration on MITRE ATT&CK →
Section titled “Events Related to Exfiltration”

Explore this tactic in the map.