ATT&CK Exfiltration Tactic: Detecting Data Leaving Through Cloud, Web and AI Channels

By the time data reaches the Exfiltration tactic (TA0010) the adversary already holds it, and the only remaining question is whether defenders see it leave. MITRE ATT&CK v20 defines the tactic as the adversary "trying to steal data" and notes that data is often compressed or encrypted, sent over the command and control channel or an alternative channel, and sometimes split into size limited transfers. This hub covers all 20 techniques and sub-techniques in the v20 Enterprise matrix, ranks which ones defenders should cover first, shows how real campaigns chain them, and sets out detection and mitigation priorities across the whole tactic. It is written for SOC analysts, detection engineers, data security owners and cloud and SaaS administrators. Each technique has its own deeper page where one exists; this page links them rather than repeating them.

Key takeaways

• The C2 channel carries most recorded theft. In the v20 dataset Exfiltration Over C2 Channel (T1041) has 211 "uses" relationships, more than every other technique in the tactic combined, so outbound session analytics matter more than channel blocking.
• Trusted web and cloud services are the second front. Exfiltration to Cloud Storage (T1567.002) has 44 recorded uses, including 25 groups, second only to T1041 (28 groups) in the tactic.
• Cloud and SaaS theft often never crosses your perimeter. Transfer Data to Cloud Account (T1537), webhooks (T1567.004) and bulk API exports through a stolen OAuth grant all look like normal API use, so the evidence is in provider audit logs, not network sensors.
• AI agents are now an exfiltration channel. v20 adds AI-Enabled Exfiltration (T1700): an injected prompt makes an enterprise AI agent use its own sanctioned tools to move data out.
• Data Loss Prevention is the most mapped mitigation. M1057 Data Loss Prevention is linked to 10 of the 20 techniques, Network Intrusion Prevention (M1031) to 7 and Filter Network Traffic (M1037) to 5.

What the Exfiltration tactic means in practice

Exfiltration sits between Collection (TA0009), where data is found, gathered and staged, and Impact (TA0040), where it is used for extortion, sale or disruption. In ransomware double extortion, data theft is the step that turns an outage into a disclosure event. In espionage it is often the only goal. Because the adversary chooses the channel, defenders cannot block every route; the practical aim is to make bulk movement of data visible, slow and attributable to an identity.

ATT&CK groups the tactic into four kinds of route, which is a useful way to plan coverage:

• Existing channels: data rides the C2 channel (T1041) or a scheduled or automated job (T1020, T1029) that the attacker already controls.
• Alternative protocols and media: FTP, SMTP, DNS or encrypted protocols outside the C2 channel (T1048), other network interfaces such as Bluetooth (T1011), and USB or other physical media (T1052).
• Trusted services: cloud storage, code repositories, text storage sites and webhooks (T1567 and its four sub-techniques), plus copies to another account on the same cloud provider (T1537).
• Delegated actors: AI agents induced to move data (T1700), and network traffic mirroring that silently copies traffic to an attacker collector (T1020.001).

See the Data Exfiltration Guide for the discipline view (DLP, egress design, response). This page stays at the ATT&CK tactic level.

Every technique in the tactic

The table lists every current (not revoked or deprecated) technique and sub-technique with the Exfiltration tactic in the ATT&CK v20 Enterprise bundle. "Recorded uses" counts the "uses" relationships from groups, campaigns, malware and tools in that bundle. Linked names open the NHI Mgmt Group technique page.

Mitigation key: M1017 User Training, M1018 User Account Management, M1021 Restrict Web-Based Content, M1022 Restrict File and Directory Permissions, M1028 Operating System Configuration, M1030 Network Segmentation, M1031 Network Intrusion Prevention, M1034 Limit Hardware Installation, M1037 Filter Network Traffic, M1041 Encrypt Sensitive Information, M1042 Disable or Remove Feature or Program, M1048 Application Isolation and Sandboxing, M1054 Software Configuration, M1057 Data Loss Prevention. See the ATT&CK Mitigations hub for each one. A count of zero means no procedure example is recorded in v20, not that the technique is unused.

Where to start: ranked techniques for defenders

The ranking below weighs three things: how often the technique appears in the v20 procedure data, how much data a single use can move, and whether ordinary controls already see it. It is a starting order, not a measure of risk in your environment.

1. T1041 Exfiltration Over C2 Channel. 211 recorded uses (166 of them malware), used by groups including Lazarus Group, Sandworm Team, Mustang Panda and Scattered Spider. Blocking is rarely possible because the channel is already open, so the work is outbound volume and ratio analytics per host, plus TLS inspection or JA3/JA4 style fingerprinting where policy allows.
2. T1567.002 Exfiltration to Cloud Storage. 44 recorded uses including Akira, Medusa Group, Kimsuky, LuminousMoth and Mustang Panda. Uploads to consumer storage such as MEGA or personal Dropbox and Google Drive accounts blend with business traffic. Tenant restrictions and a sanctioned storage list do most of the work.
3. T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol. 35 recorded uses including OilRig, APT32, Wizard Spider, FIN8 and Salt Typhoon. FTP, plain HTTP and DNS tunnelling are the classic cases, and egress filtering by protocol and destination stops much of it.
4. T1020 Automated Exfiltration and T1029 Scheduled Transfer. 32 and 18 recorded uses. Scripts and implants that send each new file as it is collected. Beaconing and periodicity analytics catch the schedule even when each transfer is small.
5. T1030 Data Transfer Size Limits. 21 recorded uses including APT28, APT41 and Play. Chunking defeats single threshold alerts, so sum bytes per destination per identity over hours and days, not per connection.
6. T1537 Transfer Data to Cloud Account and SaaS API exports. Only 3 recorded uses (Storm-0501, INC Ransom, RedCurl), but one action can copy an entire storage account, snapshot or database. Rank it high in any cloud heavy estate.
7. T1700 AI-Enabled Exfiltration. No procedure example yet, but ATT&CK added it because AI agents with mail, web and repository tools are a ready made channel. Cover it wherever an agent can both read sensitive data and send output somewhere.

How adversaries chain exfiltration

ATT&CK campaign and group records show exfiltration as the end of a short chain that usually starts with an identity, not malware.

SaaS data theft through a connected app

The ATT&CK campaign C0059 Salesforce Data Exfiltration describes UNC6040 using voice phishing (T1598.004) from October 2024 to compromise Salesforce instances, followed by extortion from a separate actor claiming to be ShinyHunters. Google Threat Intelligence reports that victims were persuaded to approve a modified Data Loader as a connected app, that the actor ran small test queries before bulk extraction, and later used custom Python scripts over Tor, with access and exfiltration from Mullvad VPN addresses. In ATT&CK terms this is T1567 and T1020 sitting on a valid OAuth grant. The ShinyHunters Salesforce Data Theft Campaign 2025 page covers the incident and the connected app controls that would have stopped it.

Data warehouse theft with stolen credentials

In the 2024 Snowflake customer intrusions, Mandiant reports that UNC5537 logged in with infostealer credentials on accounts without MFA, staged query results into temporary stages, downloaded them in compressed chunks of up to 5 GB, and stored data on VPS providers and MEGA. The chain is valid accounts, then bulk staging, then size limited transfer (T1030) and cloud storage (T1567.002). The lesson is that warehouse query history and stage activity are exfiltration telemetry. See the Snowflake Breach 2024 page.

Agent driven exfiltration

ATT&CK lists T1567 under campaign C0062, the Anthropic AI-orchestrated Campaign of September 2025, in which a likely China nexus actor (GTG-1002) used Claude Code agents for reconnaissance through to exfiltration at about 30 entities, and T1020 under C0064, an AI-assisted breach of Mexican government institutions. Separately, T1700 covers the inverse case: an enterprise agent turned against its owner by prompt injection. The EchoLeak 2025 disclosure (fixed server side as CVE-2025-32711, with no exploitation in the wild reported by Microsoft) shows the pattern: a crafted email made an assistant place internal data into a link the browser fetched automatically. The ATLAS equivalents are MITRE ATLAS AML.T0086 Exfiltration via AI Agent Tool Invocation and MITRE ATLAS AML.T0024 Exfiltration via AI Inference API.

Network level copying

Traffic Duplication (T1020.001) is recorded against Salt Typhoon. Mirroring on network devices or IaaS traffic mirroring sessions copies traffic to an attacker collector without any host level transfer, so the only evidence is a configuration change on the device or a cloud API call creating a mirror session.

Where identity fits

Almost every large exfiltration in the cases above was carried out by a legitimate identity: a user session, an OAuth connected app, a service account password, a cloud access key or an AI agent's delegated permissions. That changes what defenders should baseline. The useful question is not "which host sent 40 GB" but "which identity read and moved more data than it ever has, to a destination it has never used".

• Integration users and connected apps: limit "API Enabled" and bulk export permissions to named integrations, and review each OAuth grant's scopes and owner. See How to review Salesforce connected apps and integration users.
• Cloud keys and service accounts: a key that can call snapshot sharing, bucket replication or SAS token creation can perform T1537 without any data leaving the provider's network.
• AI agents: give agents separate identities with scoped tool permissions, so that an agent which reads mail cannot also post to arbitrary URLs. The Investigating Agent-Initiated Data Exfiltration guide covers the response side.

Detection priorities across the tactic

Every v20 exfiltration technique now has a named detection strategy (for example DET0348 for T1041, DET0570 for T1567.002, DET0573 for T1537 and DET0927 for T1700). Across them, five telemetry sources carry most of the coverage.

Two design points apply across the table. First, aggregate over time and identity, not per connection, or T1030 chunking defeats the alert. Second, record the destination's reputation and age: transfers to domains or accounts first seen in the last 30 days deserve priority.

Mitigation priorities and rollout

The mitigation mappings point to a layered approach: filter where you can, inspect where you must, and restrict who can move data at all.

1. Inventory egress paths: list sanctioned storage, file transfer, repository and messaging services, and every identity (human, service account, OAuth app, agent) with bulk export rights.
2. Close the cheap routes (M1037, M1030): default deny outbound for servers, block FTP, raw SMTP and direct DNS from endpoints, and force DNS through monitored resolvers. Test in log only mode for two weeks before enforcing.
3. Restrict web services (M1021): use tenant restrictions so only corporate tenants of storage and collaboration services are reachable, and block paste and anonymous file sharing categories. Pilot with one business unit, keep an exception process, and roll back by category if business flows break.
4. Deploy DLP where data concentrates (M1057): start with monitor mode on proxy uploads, email and SaaS exports for the most sensitive data classes; move to block for high confidence matches only.
5. Lock down cloud sharing (M1018, M1054): use organisation policies or service control policies to deny snapshot sharing and replication to accounts outside the organisation, and alert on attempts.
6. Control agents (M1048, M1022): sandbox agent tools, restrict which destinations agent tools can reach, and strip or block auto fetched links and images in agent output.
7. Close removable media where it is not needed (M1034, M1042): device control policies on servers and high value workstations.

Small vs large organisations: a small team gets most value from steps 1, 3 and 5 plus SaaS audit logs routed to one place. Large estates with a SOC should add steps 2 and 4 and build the identity level baselines described above.

Measuring coverage

• Technique coverage: share of the 20 techniques with at least one tested detection or blocking control (target all except those your platforms do not support).
• Egress visibility: percentage of outbound traffic passing through a logging proxy, firewall or resolver.
• Bulk export rights: number of identities with bulk export or API Enabled permissions, tracked downward quarter on quarter.
• Detection time: median time from a test bulk transfer (purple team) to alert.
• Unsanctioned storage uploads: volume to non corporate storage tenants per month.

Framework mapping

Common failure patterns

• Only watching the perimeter. T1537 and SaaS API exports never touch your network sensors; without cloud and SaaS audit logs, the largest thefts are invisible.
• Per connection thresholds. A single "over 1 GB" rule misses chunked (T1030) and scheduled (T1029) transfers.
• Allowing any tenant of a trusted service. Allowing a storage domain allows personal accounts on it too, which is exactly how T1567.002 hides.
• Unreviewed bulk export rights. Connected apps and integration users with broad API rights were the route in the Salesforce data theft campaign.
• Agents with read and send powers combined. An assistant that can read mail and render external links is a T1700 channel waiting for a prompt.

Practitioner checklist

• Confirm you can see outbound bytes per host and per identity, aggregated over at least 24 hours.
• Route DNS through monitored resolvers and alert on tunnelling indicators.
• Enforce tenant restrictions for storage and collaboration services and block paste sites.
• Deny cross organisation snapshot sharing and replication by policy, and alert on attempts.
• Review every OAuth connected app and integration user with bulk export or API rights.
• Collect SaaS event logs for exports, report downloads and new webhooks.
• Scope AI agent tools so read access and outbound send are separated, and block auto fetched content in agent output.
• Test at least one technique per route family (C2, alternative protocol, web service, cloud account) in a purple team exercise each quarter.

Standards and references

• MITRE ATT&CK: Exfiltration, Tactic TA0010
• MITRE ATT&CK: AI-Enabled Exfiltration, T1700
• MITRE ATT&CK: Salesforce Data Exfiltration, Campaign C0059
• MITRE ATT&CK: Anthropic AI-orchestrated Campaign, C0062
• Google Threat Intelligence: UNC6040 voice phishing and Salesforce data extortion
• Google Threat Intelligence (Mandiant): UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: Data Exfiltration Guide · Data Exfiltration Playbook · ATT&CK Collection Tactic · ATT&CK Mitigations · Microsoft Graph Exfiltration Detection