Look for repeated encrypted outbound connections with small payloads, unusual raw TCP use and host activity that ends in self-deletion. Those patterns can hide the burst behaviour many legacy detections depend on. Effective monitoring combines endpoint process context with network behaviour so that low-volume exfiltration still stands out.
How stealthy infostealer exfiltration hides from legacy detections
Stealthier infostealer activity often looks less like a burst theft event and more like a quiet, repeated trickle. Small encrypted egress, raw TCP usage, and process chains that end in self-deletion can all make the transfer harder to distinguish from ordinary background traffic, especially if defenders only alert on large uploads or obvious malware signatures.
That is why investigators need to treat transport behaviour and host behaviour as one story, not two separate ones. When a stealer is trying to stay below a payload threshold, the network view may look harmless on its own, while the endpoint view shows the parent process, child process, and cleanup pattern that explain why the traffic matters.
Effective detection is strongest when telemetry can tie outbound sessions back to the process that created them, the command line that launched them, and the timing of any file or process deletion. That context makes low-volume exfiltration visible even when the data transfer itself is deliberately mundane.
What defenders should watch for on the wire and on the host
Repeated encrypted outbound connections to the same destination, especially when each transfer is small, are more useful than single large spikes for spotting modern stealer behaviour. Raw TCP use, unusual ports, and short-lived sessions can indicate a custom channel built to avoid the patterns that common web proxy and DLP rules expect.
On the host side, the strongest clue is often the sequence of events around the transfer. A suspicious process that stages data, opens repeated network connections, and then removes itself or drops its own files after execution is behaving differently from normal enterprise software. That end-of-life behaviour is valuable because it can remain visible even when the payload volume is intentionally low.
Process context is what turns these signals into a practical detection hypothesis. If the parent process is unusual for the endpoint, the binary has no clear business purpose, or the activity starts from a user-facing process that should not be speaking raw TCP, the combination deserves investigation even if each individual element looks minor.
Why this pattern slips past volume-based monitoring
Many legacy detections still assume that exfiltration is noisy. They are tuned to large archives, obvious compression, or a single obvious transfer event. Stealthier infostealers break that assumption by spreading theft across repeated low-volume sessions, encrypting the traffic, and cleaning up after themselves so there is less forensic residue on disk.
That matters because the attacker does not need a big transfer to succeed. Session cookies, browser data, API tokens, and saved credentials can be valuable in very small quantities, so a quiet pattern can still have high impact. Monitoring has to treat persistence of pattern, not just payload size, as a detection dimension.
Endpoints and networks each miss part of the picture when used alone. Network monitoring can confirm the communication pattern, but endpoint telemetry is what shows whether a normal application, a script, or a newly dropped binary initiated it. The best detections join those views before alerting.
Risk and Threat Considerations
Stealthy infostealer exfiltration is dangerous because it can stay below the thresholds that many teams use to separate routine outbound traffic from suspicious transfer activity. Once the initial theft is quiet, the same stolen material can be reused for access, lateral movement, or follow-on intrusion without creating a large immediate spike in network volume.
Failure mechanism: The infostealer fragments exfiltration into repeated small encrypted sessions, uses nonstandard transport such as raw TCP, and removes its own artefacts to reduce host-side evidence and frustrate signature-based detection.
Impact: Security teams may miss credential and session theft until those secrets are already being used elsewhere, which shortens response time and increases the chance of account compromise, token reuse, or secondary intrusion.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1041 — Exfiltration Over C2 Channel | Stealthy small encrypted exfiltration maps to covert data transfer behavior. |
| T1071 — Application Layer Protocol | Encrypted outbound sessions and atypical protocol use can hide theft in normal-looking traffic. | |
| T1027 — Obfuscated Files or Information | Encryption and concealment are core ways infostealers reduce detection surface. | |
| Recommendation — Hunt for low-and-slow exfiltration patterns and correlate them with process telemetry. Inspect protocol anomalies and flag uncommon outbound channels for review. Prioritise detections that look for concealment plus suspicious egress behavior. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Endpoint and network correlation depends on retained logs from both layers. |
| CIS-10 — Malware Defenses | Infostealers are malware whose stealth requires behavior-based detection. | |
| Recommendation — Centralise endpoint and network logs so low-volume exfiltration can be correlated. Use behavior-based malware detections that do not depend on large transfers. | ||
Practitioner Guidance
What to verify: Confirm whether repeated small egress events are tied to a process that is not expected to initiate outbound connections, and check whether the destination, port, or protocol is atypical for that host role.
What to prioritise: Correlate endpoint process telemetry with network logs first, because that pairing is what distinguishes a noisy but legitimate background service from a quiet theft routine. Infostealer Threat Guide is the most directly relevant internal starting point for that workflow.
Decision rule: If you see repeated encrypted outbound sessions plus self-deletion or other cleanup activity, treat the event as potential compromise and move to credential and session review before you wait for a larger-volume indicator.
What practitioners underestimate: A low-volume channel can still carry high-value material, so the real question is whether the activity pattern matches a stealer workflow, not whether the payload size looks dramatic.
Practitioner takeaway: The most reliable detections combine transport anomalies with endpoint context, because stealthy infostealers try to hide the transfer in the network layer while leaving their strongest clues in process behaviour and cleanup.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org