Exfiltration Channels and Their Signals
Compare how infostealers move collected data and what defenders can observe at each channel.
In this lesson, you will learn to:
- Compare common infostealer exfiltration channels and identify observable network and endpoint signals.
Exfiltration Channels and Their Signals
This lesson compares web requests, messaging APIs, file transfer, and email as exfiltration paths. You will learn to reason from destination, timing, volume, and process context without assuming that a familiar service is malicious by itself.
The Channel Is Part of the Evidence
Infostealers can send collected data through ordinary web traffic, messaging APIs, file-transfer services, email, or attacker-controlled infrastructure. A channel alone is not a verdict. Telegram, cloud storage, and web hosting all have legitimate uses. The useful question is whether the process, destination, timing, payload shape, and user context fit the expected behavior of that device.
Compare channels by their operational trade-offs. A web request can blend into normal traffic but may reveal an unusual destination or archive upload. A messaging API can provide fast attacker notifications but may leave distinctive process and DNS evidence. Email can be hidden among normal traffic but is constrained by account and attachment behavior. File-transfer services may be legitimate, so ownership, volume, and timing matter.
Detection should combine endpoint and network evidence. Look for a new process reading browser stores, archive creation, a connection soon afterward, and an identity event that indicates session reuse. Preserve timestamps and destination details, then let an authorized response process determine whether the activity is an incident.