MITRE ATT&CK Exfiltration (TA0010): Detect data theft before it leaves your environment

What is exfiltration (TA0010)?

In the MITRE ATT&CK framework, exfiltration (TA0010) is the tactic where adversaries move stolen data out of your environment. This is the moment where confidentiality loss becomes real business impact: intellectual property leaves the network, regulated records become reportable exposure, and incident response shifts from containment to legal and regulatory operations.

Exfiltration succeeds when defenders monitor events in isolation. A single outbound connection rarely looks malicious by itself. A staged archive, followed by an unusual protocol path, followed by unexpected identity behavior tells a different story. ManageEngine Log360 is strongest when these signals are correlated into an attack narrative rather than treated as disconnected alerts.

Why exfiltration is high impact

Most organizations discover exfiltration late because attackers intentionally throttle transfers, blend into sanctioned channels, or split data across multiple protocols. By the time a single tool catches one transfer, the larger campaign may already be complete. The operational objective is not to detect one packet stream; it is to detect data-theft behavior as it evolves from staging to outbound movement.

Exfiltration pressure is also regulatory pressure. Data theft can trigger notification obligations under ISO 27001, breach reporting workflows in regional privacy laws, and incident handling expectations in NIST SP 800-61. The SOC therefore needs evidence quality, not just alert volume. Log360 preserves timeline context that legal, compliance, and IR teams can act on quickly.

Technique coverage at a glance

Detecting exfiltration over alternative protocol (T1048)

T1048 appears when adversaries move data through channels that are less monitored for bulk transfer. That can mean FTP-like paths, remote administration channels, DNS service abuse, or collaboration workflows that blend into normal operations. Detection depends on finding protocol misuse and endpoint intent in the same time window.

Log360 surfaces protocol misuse with built-in rules such as FTP Improper Address/Port Specified (Cisco, Trouble), which highlights suspicious FTP targeting behavior, and DNS-service abuse indicators including Unusual Child Process of dns.exe and Unusual File Deletion by Dns.exe (Windows, Trouble). These are high-value because they indicate abuse of infrastructure services that normally should not initiate suspicious child execution or destructive file activity.

For sensitive directory data staging, the combination of Ntdsutil Abuse (AD, Trouble), NTDS.DIT Created by Uncommon Process (AD, Attention/Trouble), and NTDS Exfiltration Filename Patterns (AD, Trouble) gives defenders a practical path to detect one of the most damaging forms of exfiltration: theft of AD credential databases for later offline cracking and privilege expansion.

Detecting exfiltration over C2 channel (T1041)

T1041 describes data theft through an already established command-and-control path. This is attractive to attackers because the channel often already bypasses perimeter controls. Instead of opening a new transfer route, they piggyback exfiltration on a session that security tools may classify as known remote activity.

In practice, defenders should combine documented outbound-anomaly signals like Uncommon Outbound Kerberos Connection (Windows, Trouble) with endpoint and identity context to distinguish routine administration from covert transfer. Where remote-access abuse is part of the campaign, Outbound RDP Connections Over Non-Standard Tools (Windows, Trouble) provides additional directional signal.

Detecting cloud-storage exfiltration (T1567)

Cloud and collaboration channels are now frequent exfiltration paths because they look operationally legitimate. Attackers abuse Teams, sanctioned SaaS, or temporary cloud identities to move data in small, hard-to-flag increments. Traditional DLP-only views can miss the attacker context that reveals intent.

Log360 provides direct signal through Files uploaded to Teams (Microsoft 365, Attention), which is useful when correlated with unusual account activity and privilege changes. In cloud-connected environments, identity or key lifecycle anomalies such as AWS EC2 Instance Connect SSH Public Key Uploaded (AWS, Trouble) can indicate attacker preparation for alternate transfer routes even when explicit exfiltration signatures are absent.

For this technique, strong outcomes come from layered analytics: sanctioned-app upload monitoring, user behavior baselines, and destination novelty scoring. Log360 can orchestrate these sources into a single SOC view so analysts can evaluate whether the transfer is business activity or covert data movement.

Signals and telemetry architecture

Exfiltration visibility is only as strong as source diversity. A mature Log360 exfiltration pipeline should include:

• Endpoint execution telemetry: Process creation and command-line events to detect staging tools and archive workflows.
• Directory and file telemetry: AD and file-share access signals to identify sensitive data targeting before transfer.
• Network egress telemetry: Firewall, DNS, VPN, and proxy logs for destination, volume, and protocol analysis.
• Cloud and collaboration telemetry: SaaS upload activity and cloud identity changes for transfer-channel abuse detection.
• User context: UEBA risk scoring to distinguish normal high-volume workflows from suspicious theft patterns.

Threat hunting queries

Use these hunting patterns in Log360 search and correlation workflows to find probable exfiltration chains:

Hunt for high-volume sensitive file reads from privileged or service identities.

Identify archive tooling on endpoints that do not normally perform packaging operations.

Pivot on high-severity outbound events in the same window as suspicious staging activity.

Monitor unusual Kerberos ticket request behavior around suspected outbound activity for identity misuse context.

Response and containment playbook

1. Contain the channel: Block suspicious destinations, disable impacted identities, and isolate suspected transfer hosts.
2. Preserve evidence: Export Log360 correlated timelines, raw logs, and account/session artifacts before cleanup.
3. Scope exposure: Identify data classes accessed, transfer windows, and systems touched by the same principal or host.
4. Coordinate legal/compliance: Trigger notification assessments based on data type and jurisdictional obligations.
5. Harden recurrence controls: Implement custom correlations for missed patterns and tighten egress policy segmentation.

How TA0010 connects to other tactics

Exfiltration is rarely the first observable signal in a campaign. Most incidents start with initial access, progress through execution and credential abuse, then move into collection before data exits. Detection engineering should therefore map TA0010 analytics to TA0001, TA0002, TA0006, and TA0009 signals so SOC teams can interrupt campaigns earlier.

Log360 supports this approach by mapping detections to MITRE ATT&CK context and enabling cross-tactic investigation. Analysts can pivot from exfiltration indicators to upstream behavior such as phishing delivery, suspicious PowerShell execution, credential dumping, and abnormal remote access to build complete incident scope.

Need to explore ManageEngine Log360? Schedule a personalized demo

FAQ