Most DLP programmes are built around compliance patterns such as card numbers and national insurance numbers, then assumed to stop data theft, without anyone checking which exfiltration routes the rules actually see. MITRE ATT&CK catalogues data loss prevention as mitigation M1057 and, in ATT&CK v20, relates it to 12 techniques and sub-techniques across the Collection and Exfiltration tactics. This guide reads M1057 as a control a security team has to implement and prove: which techniques ATT&CK says it mitigates, what DLP must inspect to make that true, the routes it cannot see, and how to measure coverage technique by technique. It is for detection engineers, data protection leads and architects who already run or are buying DLP. For DLP fundamentals, classification and policy tuning, see the Data Loss Prevention (DLP) Guide; this page does not repeat it.
Key takeaways
- M1057 is a narrow mitigation. ATT&CK v20 maps it to 12 techniques and sub-techniques (7 base techniques), two in Collection and ten in Exfiltration, so DLP alone never covers the exfiltration tactic.
- Every mapping assumes inspection. ATT&CK's own usage text says DLP can detect and block sensitive data over unencrypted protocols, browser uploads, USB and external sharing; an encrypted C2 channel or a non-browser client defeats most of that.
- Measure by channel, not by rule count. Build a matrix of the 12 mapped techniques against the DLP channels you run (endpoint, network, email, cloud, browser) and treat every empty cell as a known gap with a named compensating control.
- AI tools are now an exfiltration channel. Pasting source code into a public chatbot is a browser upload in ATT&CK terms (T1567), and major DLP platforms now document generative AI sites as a policy location.
- Machine identities move data too. Service accounts, OAuth applications and API keys transfer data without a user at a keyboard, so DLP has to cover API and cloud-to-cloud paths, not only endpoints.
What M1057 is in ATT&CK
ATT&CK describes Data Loss Prevention as strategies and technologies to identify, categorise, monitor and control the movement of sensitive data, covering formats such as personal data, intellectual property and financial data, with DLP integrated into network, endpoint and cloud platforms. The mitigation page (version 1.1, last modified 10 December 2024) lists five implementation measures, which are a useful skeleton for a programme:
| ATT&CK measure | What ATT&CK says it means | What a team actually has to build |
|---|---|---|
| Sensitive Data Categorization | Scan and tag files using predefined patterns such as Social Security numbers or card details | Classifiers and labels for your own crown jewels (source code, designs, contracts, keys), not only regulated identifiers |
| Exfiltration Restrictions | Block unapproved email attachments, unauthorised USB use and unencrypted uploads to cloud storage | Enforce-mode rules per channel, with a written exception process |
| Data-in-Transit Monitoring | Network DLP inspecting outbound traffic and blocking unapproved transmissions | A decision on where TLS is inspected and where it is not; see M1020 SSL/TLS Inspection |
| Endpoint Data Protection | Endpoint agents blocking copy and paste of sensitive data, unauthorised printing or file sharing | Agent coverage on every managed Windows and macOS device, including privileged admin workstations |
| Cloud Data Security | Integrate DLP with Google Drive, OneDrive or AWS to restrict sensitive sharing or downloads | API-based policies in each SaaS and cloud storage service, plus external sharing controls |
D3FEND's ATT&CK mitigation mapping file relates 42 enterprise mitigations to defensive techniques but contains no entry for M1057. The closest D3FEND countermeasures, which D3FEND relates to other mitigations, are User Data Transfer Analysis (D3-UDTA), Outbound Traffic Filtering (D3-OTF) and IO Port Restriction (D3-IOPR). See the MITRE D3FEND Guide.
Techniques ATT&CK says M1057 mitigates
All 12 relationships in ATT&CK v20 are listed below, grouped by tactic, with ATT&CK's own usage text paraphrased and a priority from NHI Mgmt Group based on how often each route matters in real exfiltration and how much DLP can realistically see.
| Technique | Tactic | How DLP helps, per ATT&CK | Realistic DLP leverage |
|---|---|---|---|
| T1567 Exfiltration Over Web Service | Exfiltration | Detect and block sensitive data uploaded to web services via browsers | High for managed browsers; low for command-line or custom clients |
| T1567.004 Exfiltration Over Webhook | Exfiltration | Same browser upload usage text as T1567 | Low: webhooks are usually called by scripts and integrations, not browsers |
| T1537 Transfer Data to Cloud Account | Exfiltration | Prevent sensitive data being shared with people outside the organisation; ATT&CK cites Microsoft Purview and Google Workspace DLP | High where SaaS and cloud DLP are API-integrated |
| T1052 Exfiltration Over Physical Medium | Exfiltration | Detect and block sensitive data copied to physical media | High on managed endpoints with an agent |
| T1052.001 Exfiltration over USB | Exfiltration | Detect and block sensitive data copied to USB devices | High on managed endpoints; pair with M1034 Limit Hardware Installation |
| T1048 Exfiltration Over Alternative Protocol | Exfiltration | Detect and block sensitive data uploaded via web browsers | Medium: depends on protocol visibility at the egress point |
| T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | Exfiltration | Detect and block sensitive data uploaded via web browsers | Low without TLS inspection |
| T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol | Exfiltration | Detect and block sensitive data sent over unencrypted protocols | High at network egress: content is visible |
| T1041 Exfiltration Over C2 Channel | Exfiltration | Detect and block sensitive data sent over unencrypted protocols | Low: most C2 is encrypted or encoded |
| T1020.001 Traffic Duplication | Exfiltration | Monitor and control flow of sensitive information, for example blocking forwarding of email to external recipients and using email flow rules | Medium for email; low for network-device mirroring |
| T1005 Data from Local System | Collection | Restrict access to sensitive data and detect sensitive data that is unencrypted | Medium: discovery scans find exposed data before an attacker does |
| T1025 Data from Removable Media | Collection | Restrict access to sensitive data and detect sensitive data that is unencrypted | Medium: scanning and labelling data on attached media |
Two points stand out. First, ten of the twelve mappings are in Exfiltration, so DLP is mostly a last-line control: by the time it fires, collection and staging have already happened. Second, ATT&CK's usage text for T1048.002 and T1567.004 is the generic browser upload sentence, which overstates what DLP sees on those routes. Read the mapping as "DLP can help on this route if it can see the content", not as coverage.
Gaps: what M1057 does not stop
A coverage claim is only as good as its exclusions. These are the classes of exfiltration DLP structurally misses, with the mitigation or detection that should cover each one.
| Gap class | Why DLP misses it | What covers it instead |
|---|---|---|
| Encrypted or encoded content | Archives with passwords, custom encryption or encoding before transfer hide content from pattern matching | Volume and destination analytics, M1031 Network Intrusion Prevention, endpoint behaviour rules |
| Uninspected TLS | Network DLP sees only metadata where TLS is not decrypted | M1020 SSL/TLS Inspection where lawful and proportionate, plus endpoint DLP |
| Unmanaged devices and personal accounts | No agent and no tenant policy applies | Conditional access, session controls, blocking sync to unmanaged devices |
| Machine-to-machine transfer | Service accounts, OAuth applications and API keys call storage APIs directly, often to other cloud accounts | M1037 Filter Network Traffic egress allowlists, cloud audit logs, least privilege under M1018 User Account Management |
| Low and slow transfers | Small chunks and scheduled transfers stay under thresholds | Baselines of per-identity data egress over days and weeks |
| Data that matches no classifier | Unlabelled designs, internal strategy, model weights | Fingerprinting and labelling of known sensitive repositories; access restriction under M1022 Restrict File and Directory Permissions |
The base technique T1020 Automated Exfiltration has no mitigation in ATT&CK v20; only its sub-technique Traffic Duplication is related to M1057. See MITRE ATT&CK T1020 Automated Exfiltration for detection.
Implementing M1057 against the technique list
NHI Mgmt Group recommends rolling out DLP in the order of the technique table, because it front-loads the routes where DLP has the most leverage.
- Inventory channels and owners. List every egress route: managed browsers, email, SaaS sharing, cloud storage, USB, print, network egress points, developer tooling and AI assistants. Record which DLP engine, if any, inspects each.
- Define the data that matters. Beyond regulated identifiers, fingerprint source repositories, design documents, customer exports and credential formats (cloud keys, private keys, tokens). ATT&CK's categorisation measure is the foundation for every other measure.
- Start with SaaS and cloud sharing (T1537, T1567). API-integrated DLP in collaboration suites has low friction and high value. Microsoft documents Purview DLP across Exchange, SharePoint, OneDrive, Teams, Windows and macOS endpoints, and non-Microsoft cloud apps; Google documents Workspace DLP across Drive, Gmail, Chat, Chrome and Calendar, with block, warn and audit actions.
- Endpoint removable media (T1052, T1052.001, T1025). Deploy endpoint DLP to block sensitive copies to USB, alongside device control. See the Removable Media and USB Control Guide.
- Browser and AI uploads (T1567). Apply policy to uploads and pastes into generative AI sites from managed browsers. Microsoft's documentation lists ChatGPT, Gemini, DeepSeek and Copilot among generative AI sites covered by its Edge for Business and network options, and Microsoft 365 Copilot as a DLP location in preview. See the Generative AI Data Loss Prevention Guide.
- Email forwarding (T1020.001). Use mail flow and DLP rules to block automatic forwarding of sensitive content to external recipients, and review existing forwarding rules.
- Network egress (T1048.003, T1041, T1048.002). Inspect unencrypted protocols first, then decide where TLS inspection is justified.
- Test before enforcing, and keep a rollback. Run each new policy in simulation or audit mode (Purview recommends simulation mode, review and tuning before enforcement), pilot enforcement with one business unit, and keep the audit-only version ready to restore if business processes break.
AI tools and agents
The Samsung ChatGPT source code leak is the reference case: engineers pasted internal source code and meeting notes into a public chatbot at least three times in 2023, with no attacker involved, and Samsung later restricted generative AI tools on company devices. In ATT&CK terms this is a browser upload to a web service. The lesson for M1057 is that classification has to recognise source code and secrets, and policy has to apply to paste and upload actions into AI sites, not only to file transfers. AI agents add a second path: an agent with connector or tool access can move data through API calls that no endpoint agent sees. See MITRE ATLAS AML.T0086 Exfiltration via AI Agent Tool Invocation.
Where identity fits
DLP policies are scoped to users, groups and devices, but a growing share of data movement is performed by non-human identities: backup and sync service accounts, integration OAuth applications with tenant-wide file or mail scopes, CI/CD pipelines and AI agents. Three NHI Mgmt Group recommendations follow. Scope DLP and cloud data security policies to include application and service principal activity where the platform allows it. Treat new broad data scopes on an application (for example, read access to all files or all mailboxes) as a data exfiltration risk that needs approval. Include credential patterns in DLP classifiers so that keys and tokens leaving the organisation are caught, because a leaked key is a path to bulk data. See the Microsoft Graph Exfiltration Detection guide for the API-side view.
Verifying coverage and measuring it
Treat M1057 coverage as a matrix: the 12 mapped techniques as rows, your DLP channels as columns. A cell is covered only when a policy exists in enforce or alert mode and a test has proved it fires.
- Test with synthetic data: use test strings that match your classifiers (vendor test patterns or synthetic records) and attempt each mapped route in a controlled pilot: USB copy, browser upload, personal cloud share, external forward, unencrypted protocol transfer.
- Log what you need: DLP rule matches, overrides with justification, policy changes, and egress volume per identity. Purview records monitored activity in the Microsoft 365 audit log and Activity explorer; Google documents DLP reporting through Data Protection Insights, the alert centre and the security dashboard.
- Correlate with exfiltration detection: DLP alerts are one input; volume, destination and timing analytics catch encrypted transfers DLP cannot read. See the Data Exfiltration Guide.
| Metric | What it shows | Target direction |
|---|---|---|
| Technique cells covered and tested (of 12 times your channels) | Real ATT&CK coverage, not rule count | Up, with gaps named |
| Managed endpoints with a healthy DLP agent | Whether endpoint rows are real | Close to 100% |
| Share of policies in enforce mode versus audit | Whether DLP prevents or only observes | Up for high-confidence rules |
| Override rate and false positive rate per rule | Policy quality and user friction | Down |
| Applications and service accounts with broad data scopes reviewed | Machine-path exposure | All reviewed on a fixed cycle |
| Median time from DLP alert to triage | Whether alerts lead to action | Down |
Common failure patterns
- Compliance-only classifiers. Rules catch card numbers but not source code, keys or design files, so the data an attacker actually wants passes untouched.
- Audit mode forever. Policies are left in simulation after the pilot, and the DLP console becomes a record of losses rather than a control.
- Browser-only thinking. T1567 is covered for managed browsers while command-line tools, sync clients and webhooks reach the same services unseen.
- Ignoring AI paste paths. Uploads are blocked but paste into chatbots is not, which is exactly how the Samsung leak happened.
- No machine identity scope. Policies cover users while integration apps with tenant-wide file access are never reviewed.
- Coverage claimed from the mapping. A team reports the 12 ATT&CK techniques as mitigated because DLP is deployed, without testing any route.
Framework mapping
| Framework | Reference | Relevance to M1057 |
|---|---|---|
| MITRE ATT&CK v20 | M1057; TA0010 Exfiltration; TA0009 Collection | Technique relationships listed above |
| NIST SP 800-53 Rev 5 | AC-4 Information Flow Enforcement; SC-7(10) Prevent Exfiltration; SI-4(4) Inbound and Outbound Communications Traffic; MP-7 Media Use | Flow control, exfiltration prevention, egress monitoring, removable media |
| NIST CSF 2.0 | PR.DS-01, PR.DS-02, PR.DS-10 | Protection of data at rest, in transit and in use |
| CIS Controls v8.1 | Control 3 Data Protection (Safeguard 3.13 Deploy a Data Loss Prevention Solution) | Direct DLP safeguard |
| ISO/IEC 27001:2022 Annex A | A.8.12 Data leakage prevention | Direct control |
| MITRE D3FEND | D3-UDTA, D3-OTF, D3-IOPR | Closest countermeasures; no direct M1057 mapping in D3FEND |
Related mitigations: M1041 Encrypt Sensitive Information, M1037 Filter Network Traffic, M1034 Limit Hardware Installation and the ATT&CK Mitigations overview.
Practitioner checklist
- Build the 12-technique by channel coverage matrix and name an owner for every gap.
- Extend classifiers to source code, credentials and your own crown-jewel repositories.
- Enable API-integrated DLP for every collaboration suite and cloud storage service in use.
- Deploy endpoint DLP with removable media rules on all managed Windows and macOS devices.
- Apply paste and upload policy to generative AI sites from managed browsers.
- Block external auto-forwarding of sensitive mail and review existing rules.
- Decide, document and review where TLS is inspected for network DLP.
- Include service accounts, OAuth apps and agents in data scope reviews.
- Pilot every policy in simulation, then enforce, keeping an audit-only rollback.
- Re-test each covered cell with synthetic data at least quarterly.
Standards and references
- MITRE ATT&CK: Data Loss Prevention (M1057)
- MITRE ATT&CK: Exfiltration (TA0010)
- MITRE ATT&CK: Exfiltration Over Web Service (T1567)
- MITRE D3FEND: User Data Transfer Analysis
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
- Microsoft Learn: Learn about data loss prevention
- Google Workspace Admin Help: About data loss prevention
Related NHI Mgmt Group resources: Data Loss Prevention (DLP) Guide, Generative AI Data Loss Prevention Guide, Data Exfiltration Guide, MITRE ATT&CK Coverage Mapping Guide, ATT&CK Mitigations.