Exfiltration Channels and Low-and-Slow Transfer
Reason about exfiltration across network, SaaS, cloud, email, removable media, and covert channels by separating transfer-shaped evidence from proof of content and intent.
Exfiltration is an objective, not one network pattern
Exfiltration means moving information outside the authority or boundary intended to protect it. The path may be a direct upload, cloud-side copy, anonymous share, email attachment, synchronized folder, removable device, DNS encoding, or repeated API reads by an external identity.
The boundary is organizational and contextual, not merely network direction. A transfer to an approved processor can cross the internet legitimately. A copy between two cloud accounts inside one provider can cross an ownership boundary without appearing as outbound traffic.
Choose the path and protected object before choosing the analytic. State who controls the source and destination, what authority should permit movement, and which observation can see the transition.
Channel evidence has specific limits
Network flow can show endpoints, timing, protocol, and byte counts. Proxy or application logs may add method, account, object, and outcome. Cloud audit can show a snapshot shared across accounts without observing a download. Endpoint evidence can show file reads and removable-device writes.
Write the strongest fact each source supports. Bytes sent do not identify content. A file read does not prove it entered the connection. A successful share changes exposure but does not show use. An API response size can suggest retrieval while omitting which records were meaningful.
Combine independent sources when possible, and label inferred joins. A shared process, session, object identifier, or transfer job is stronger than time proximity alone.
Low-and-slow changes the time scale, not the objective
An attacker can avoid a large spike by transferring small amounts over days, mixing with normal service traffic, or distributing access across identities. Fixed short windows may never cross a threshold.
Accumulate evidence by entity, object set, destination, and purpose over a period justified by the workflow. Track distinct sensitive objects, cumulative volume, new destination relationships, transfer timing, and changes after privilege or collection events. Preserve decay and reset behavior so the consumer can understand why concern grew.
Long windows increase exposure to role changes and unrelated activity. Event-time ownership, destination approval, and identity resolution must remain historically correct. A monthly total attached to today’s manager can tell the wrong story.
Encrypted traffic preserves some facts and hides others
Encryption usually hides content from a passive network observer while leaving endpoints, timing, volume, transport behavior, certificates, and sometimes server names. These features can support a destination or transfer-shape assessment, not a claim about the exact data.
Use encrypted network metadata with application and endpoint evidence. A new storage destination, long-lived upload, staged archive read, and matching process connection can strengthen concern. Shared content-delivery infrastructure and privacy relays remain important alternatives.
Do not compensate for hidden content by overstating weak metadata. State which layer supplied each fact and which content question remains unanswered.
Report movement as a chain of bounded findings
A strong result can say that a user accessed a sensitive object set, created a staged archive, and a related process uploaded a similar byte volume to a newly approved destination. It can state that the sequence is inconsistent with the user’s workflow and warrants containment. It should state whether content equivalence and destination ownership are confirmed or inferred.
Include source and destination authority, identities, objects or classification, channel, operation, outcome, timing, cumulative volume, staging context, approval, and telemetry health. Distinguish exposure, attempted transfer, successful transfer, and verified external access.
This precision allows earlier action. The consumer can stop a suspicious path without being told that every outbound byte already proves theft.
Frequently asked questions
Can outbound byte volume prove exfiltration?
No. It shows observed transfer volume at a particular point. Direction, destination, application, content lineage, authorization, outcome, and alternative workflows determine whether the evidence supports an exfiltration assessment.
