What is exfiltration?¶
The practical answer¶
Exfiltration is the unauthorised transfer of data from a system, account or environment to another location.
The key evidential caution¶
The dangerous assumption is that any large outbound transfer proves data theft.
It may not.
Legitimate activity such as backups, synchronisation, software updates, video calls and cloud services can create significant outbound traffic.
Exfiltration may occur through:
Key points¶
- web uploads
- cloud storage
- messaging
- file-transfer services
- remote-access tools
- DNS
- encrypted tunnels
- removable media
- another compromised system
What investigators should establish¶
Investigators should establish:
Key points¶
- what data was involved
- where it originated
- how it was transferred
- which account or process initiated it
- the destination
- whether the transfer completed
- what evidence links the transfer to the selected data
Network volume alone may show that data moved, but not necessarily what the data was.
A file-access event may show collection without proving transfer.
The strongest evidence links the source files, staging activity, transfer mechanism and destination.
Evidential limits¶
Do not assume that the destination account holder or hosting subscriber is the offender.
Infrastructure may be shared, compromised or rented.
Exfiltration may also be repeated in small amounts to avoid detection. A series of low-volume transfers linked to the same process, account or destination may be more significant than one isolated spike. Preserve enough historical data to identify whether the activity was sustained, intermittent or deliberately split.
Where data was moved first to another internal system, distinguish internal transfer from final exfiltration. That internal movement may be part of staging rather than proof that the information crossed the organisational boundary.
Operational takeaway¶
Prove exfiltration by linking the source data, transfer process, destination and completion rather than relying on outbound volume alone.