Exfiltration Is a Chain Before It Is a Transfer

Exfiltration Is a Chain Before It Is a Transfer

Follow sensitive information from access through preparation and transfer without relying on one volume threshold.

Data access, collection, staging, and boundary change create the fuller picture

A large outbound transfer attracts attention, but exfiltration often becomes visible earlier. Someone accesses information, collects it from one or more locations, stages it, transforms or archives it, and chooses a channel. In cloud services, the final step may be a policy change or cross-account copy that never crosses a traditional internet perimeter.

Begin with the data object. Sensitivity, owner, location, and permitted use tell you why access matters. The subject might be a human, application, service account, or workload. Its entitlement explains what it was allowed to do, while the operation shows what it actually did. A baseline can compare the access with prior or peer behavior, but volume alone is not enough: a backup service may read millions of records legitimately, while a compromised analyst may select nine valuable records.

Data Access Baselines and Sensitive-Object Context treats the baseline as an interpretable expectation. You should be able to explain which population was compared, why it is comparable, and which downstream behavior changes the meaning.

Staging concentrates collected data in a location or form suited for later use. Temporary directories, cloud buckets, database exports, archives, encoded objects, and permission changes can all participate. Backups, legal discovery, analytics, and software builds create similar patterns. Staging, Archiving, and Bulk Collection Detection therefore emphasizes the relationship among sources, destination, actor, transformation, cleanup, and later transfer rather than a particular filename or utility.

Transfer channels vary. Attackers can use web services, repositories, text sites, webhooks, alternate protocols, removable media, or ordinary command channels. Low-and-slow behavior spreads volume over time; chunking avoids a single large request. Detecting it requires longer state and a clear grouping entity. Sampling can destroy the count semantics you rely on. Exfiltration Channels and Low-and-Slow Transfer examines that tradeoff.

Cloud-native movement may grant another account access to snapshots, backups, objects, or sharing links. The important event is a boundary change: who could access the data before, who can access it now, through which authority, and for how long. Cloud Sharing Links, Snapshots, and Cross-Account Transfer connects control-plane state with later access.

No single stage proves exfiltration. Together, access, staging, authority change, and transfer can support a stronger assessment. Preserve the object and identity relationships so the analyst can see which facts establish movement and which conclusions remain inferential.

Resources

• MITRE ATT&CK Enterprise Techniques — Primary reference for the standards and concepts discussed in this lesson.