Data exfiltration is the unauthorized copying or transfer of data out of an organization’s systems to a place the attacker controls. It is usually the last step of an intrusion: the attacker first gets into the network and gains privileges, then takes what they came for — customer records, intellectual property, passwords, or source code. In the MITRE ATT&CK model this maps to tactic TA0010 (the exfiltration phase). The data can be taken by an outside attacker running malware or by an insider abusing their legitimate access.

How does data exfiltration differ from data leakage and a data breach?

These three terms are easy to mix up, but they mean different things:

Data exfiltration — a deliberate transfer of data to the outside. Someone acts on purpose: they pick a channel, then pack and encrypt the data before sending it.
Data leakage — accidental disclosure: a misconfigured cloud store, a public storage bucket, a file sent to the wrong person. No bad intent.
Data breach — the broadest term: any unauthorized access to data. Exfiltration is one possible result of a breach, but a breach can end without anything leaving the environment.

Which channels are used to move data out?

Attackers pick a path that blends into normal traffic and avoids raising an alarm at the network edge. The most common channels are:

HTTP/HTTPS (ports 80/443) — the number-one channel. Data goes out as POST requests, hidden in the URL or headers, or pushed to cloud services. TLS encryption makes it hard to look at the content.
DNS tunneling — data is encoded into subdomain names in DNS queries (for example in TXT or NULL records, in very long, random-looking labels). DNS is rarely filtered and almost always allowed through the firewall, which makes it a popular, slow channel — also used for remote control (C2, or command and control).
ICMP tunneling — data stuffed into echo request/reply packets (an ordinary ping), disguised as diagnostic traffic.
Cloud services and storage — uploads to legitimate services (drives, code repositories, messaging apps, webmail) that are hard to tell apart from normal work.
Corporate email — attachments sent to personal addresses or to outside parties.
Physical media and USB — copying to a flash drive, external disk, or memory card. A classic insider channel, invisible to network tools.
Covert channels — data hidden in TCP/UDP packet fields, or communication that never writes a file to disk.

How does an exfiltration attack unfold?

Exfiltration is rarely the first move. It is usually preceded by a few steps:

Getting into the network — phishing, stolen passwords, or exploiting a vulnerability or misconfiguration.
Discovery and lateral movement — finding valuable data, gaining higher privileges, reaching databases and file shares.
Staging — gathering the data in one place, then compressing and encrypting it to shrink its size and hide its content.
Exfiltration — sending it over the chosen channel, often in small chunks and during low-traffic hours, sometimes through a command-and-control (C2) server that checks in at regular intervals.

How do you detect data exfiltration?

More and more traffic is encrypted, so often you cannot look at the content itself. Detection then relies on metadata and unusual behavior — who sends what, when, how much, and where, rather than the exact contents. The key signals and methods:

Unusual outbound traffic — sudden spikes in how much data is going out, a strange imbalance of uploads over downloads for a given host or user.
Beaconing — regular, repeating connections to the same outside address. This is a typical sign of talking to a control server, caught by analyzing the gaps between connections.
DNS analysis — random-looking and unusually long names, lots of different subdomains under one domain, a predominance of TXT/NULL records, an odd ratio of query size to response size.
Network telemetry (NDR/NetFlow) — even with TLS-encrypted traffic you can still see session size, how long it lasts, packet counts, and destination addresses. NDR (Network Detection and Response) means spotting threats from network traffic; it helps catch connections to rare or brand-new addresses.
UEBA — user and entity behavior analytics. It learns what is normal and flags deviations: reaching for unusual resources, bulk downloads, an admin account used outside business hours.
DLP — data loss prevention tools. They look at the content and context of a transfer (data classification, pattern matches such as card or ID numbers) on endpoints, in email, and in network traffic.
EDR and proxy/firewall logs — correlating events from endpoints (compressing data, launching transfer tools) with gateway logs and a SIEM.

How can the risk of exfiltration be reduced?

Good defense has several layers and combines prevention with detection:

Outbound and DNS control — limiting where data may be sent at all, enforcing a company DNS resolver, blocking tunneling and known control domains.
DLP and data classification — labeling sensitive data and enforcing transfer rules on endpoints, in the cloud, and in email.
Least privilege and Zero Trust — splitting the network into segments, continuously verifying identity, narrowing access to data.
Removable-media control — USB policies that limit writing data to flash drives and removable disks.
Encryption — both stored and in-transit data — makes stolen data less useful to an attacker.
Monitoring and behavior analytics — NDR, UEBA, and SIEM to catch deviations early and respond faster.
Patching and staff awareness — updates, security testing, and anti-phishing training that make getting in harder in the first place.

Why does exfiltration matter for the SOC and network monitoring?

Exfiltration is often the moment an incident turns into a real loss. This phase decides whether it stays at mere unauthorized access or ends in the loss of data you have to report (for example under GDPR). For a security team — the SOC, or Security Operations Center — that means focusing on seeing outbound traffic, DNS and flow telemetry, and tying endpoint signals together with network signals. Attackers are shortening the time between break-in and data being moved out, so what counts is near-real-time detection based on unusual behavior, not signatures alone.

Learn more

APT (Advanced Persistent Threat) — APTs often steal data quietly over time, making exfiltration hard to detect.
Network monitoring and network visibility – traffic analysis as the foundation of cybersecurity visibility — Traffic analysis helps spot unusual data flows that may indicate exfiltration.
Compliance and regulation with Sycope — Compliance rules often require controls and logging to help prevent data exfiltration.
DNS errors and DNS security – DNSSEC, protection against DNS attacks and DNS management errors — DNS can be abused as a covert channel for data exfiltration.
Encrypted Traffic Analysis (ETA) — ETA can reveal suspicious encrypted transfers used for data exfiltration.
BYOD (Bring Your Own Device) — BYOD increases the risk of data exfiltration through unmanaged devices.

Data Exfiltration (Wyciek danych)

Unauthorized copying or transfer of data out of an organization's systems, usually the last step of an attack; detected mainly through outbound-traffic and DNS anomaly analysis.