Exfiltration consists of techniques that adversaries may use to steal data from your network. Once they've collected data, adversaries often package it to avoid detection while removing it. This can include compression and encryption. Techniques for getting data out of a target network typically include transferring it over their command and control channel or an alternate channel.
Tactic Overview
Tactic ID: TA0010 — Matrix: Enterprise — Techniques: 9
The Exfiltration tactic represents a phase in the adversary lifecycle where the adversary is trying to steal data. This tactic is part of the MITRE ATT&CK Enterprise matrix and encompasses 9 known techniques that adversaries employ during this phase of an attack.
Understanding this tactic is critical for defenders to build effective detection strategies and implement appropriate countermeasures. Organizations should map their security controls against each technique to identify coverage gaps and prioritize defensive investments.
Techniques (9)
The following techniques are categorized under the Exfiltration tactic in the MITRE ATT&CK Enterprise matrix:
| Technique ID | Name | Description | MITRE Reference |
|---|---|---|---|
T1020 | Automated Exfiltration (1 sub-techniques) | Adversaries automate the exfiltration of collected data using scripts or malware with built-in exfiltration capabilities. | T1020 |
T1030 | Data Transfer Size Limits | Adversaries limit the size of data transfers to avoid triggering network monitoring thresholds and alerts. | T1030 |
T1048 | Exfiltration Over Alternative Protocol (3 sub-techniques) | Adversaries exfiltrate data using a protocol different from the C2 channel, such as FTP, SMTP, or DNS. | T1048 |
T1041 | Exfiltration Over C2 Channel | Adversaries exfiltrate data over the same channel used for command and control communications. | T1041 |
T1011 | Exfiltration Over Other Network Medium (1 sub-techniques) | Adversaries exfiltrate data over alternative network media like Bluetooth, cellular, or RF communications. | T1011 |
T1052 | Exfiltration Over Physical Medium (1 sub-techniques) | Adversaries exfiltrate data over physical media like USB drives, especially from air-gapped networks. | T1052 |
T1567 | Exfiltration Over Web Service (3 sub-techniques) | Adversaries exfiltrate data to cloud storage and web services (Google Drive, Dropbox, Mega) that blend with normal traffic. | T1567 |
T1029 | Scheduled Transfer | Adversaries schedule data exfiltration at specific times or intervals to blend with normal network traffic patterns. | T1029 |
T1537 | Transfer Data to Cloud Account | Adversaries transfer data to cloud accounts under their control, leveraging cloud-to-cloud transfer mechanisms. | T1537 |
Detection & Mitigation
Organizations should implement layered defenses addressing each technique within this tactic. Below are key mitigation strategies recommended by Mjolnir Security analysts.
Key Mitigations
- Data Loss Prevention
- Network monitoring for large transfers
- Restrict cloud storage access
- Monitor DNS for data exfiltration
- Egress filtering
Detection Strategies
Effective detection of Exfiltration techniques requires a combination of log analysis, behavioral monitoring, and threat intelligence correlation. Security teams should focus on establishing baselines for normal activity and alerting on deviations that may indicate adversary behavior aligned with this tactic.
- SIEM Integration: Correlate events across multiple data sources to detect technique patterns
- Behavioral Analytics: Deploy UEBA solutions to identify anomalous activity indicative of this tactic
- Threat Hunting: Proactively search for indicators of techniques within this tactic using hypothesis-driven investigations
- Purple Teaming: Regularly test detection coverage by simulating techniques from this tactic
Associated Threat Actors
The following threat actors are known to heavily leverage techniques from the Exfiltration tactic:
For comprehensive threat actor profiles, visit the APT Groups Hub.
Resources & References
Defend Against Exfiltration Techniques
Mjolnir Security provides expert threat intelligence, purple team exercises, and detection engineering services to help organizations defend against adversary tactics mapped to the MITRE ATT&CK framework.
Stay updated on MITRE ATT&CK developments and threat intelligence insights.
View All Reports →Written by Mjolnir Security Research — Published March 7, 2026