data-exfiltration-attack

name	data-exfiltration-attack
description	Attacks for exfiltrating data from compromised networks and bypassing DLP/egress controls. Covers DNS tunneling, ICMP/HTTPS tunneling, protocol smuggling, steganographic exfil, cloud-native exfil (S3/OpenSearch/BigQuery), and DLP bypass. Use when testing egress monitoring, validating DLP controls, or simulating APT exfiltration campaigns.
origin	kali-claw
version	0.2.0.2
compatibility	["kali-linux-2025-2-arm64","python-3.11+","dnscat2","iodine","chisel","merlin","sliver"]
allowed-tools	["dnscat2","iodine","dns2tcp","chisel","merlin","sliver","gost","ngrok","cloudflared","stunnel","socat","proxychains","tor","steghide","zsteg","powershell","certutil","bitsadmin","curl","python3"]
metadata	{"domain":"data-exfiltration","tool_count":19,"guide_count":2,"mitre":"TA0010-Exfiltration, TA0011-Command and Control, T1041, T1048, T1048.002, T1053, T1071, T1071.001, T1071.004, T1090, T1104, T1132, T1567, T1567.002, T1571, T1572, T1573","last_reviewed":"2026-07-26"}

Data Exfiltration Attack

Summary

Exfiltration is the final stage of the kill chain — once attackers have collected data, they must move it out without tripping DLP, IDS/IPS, SWG, or CASB controls. This domain covers the full exfiltration landscape: DNS tunneling (the most common C2/exfil channel in restricted environments), ICMP/HTTP(S) tunneling, protocol smuggling over legitimate services (Google Drive / OneDrive / GitHub / Cloudflare), steganographic exfiltration (PNG/BMP/PDF steg), cloud-native exfil (S3 cross-account, OpenSearch collection, BigQuery external tables), and DLP bypass techniques. Includes operator playbooks for egress testing, DLP validation, and APT exfiltration simulation against enterprise defenses (Zscaler/Netskope/Forcepoint/Palo Alto).

Key Terms

• Exfiltration — Unauthorized transfer of data out of a network (MITRE TA0010)
• C2 / Command and Control — Channel attacker uses to control compromised host (TA0011)
• DNS tunneling — Encoding IP/TCP traffic inside DNS queries (iodine, dnscat2)
• Domain fronting — Using legitimate CDN SNI to hide attacker origin (T1090.004)
• DLP — Data Loss Prevention (content-aware egress filter)
• SWG — Secure Web Gateway (URL + content filtering for HTTP/HTTPS)
• CASB — Cloud Access Security Broker (cloud-aware DLP)
• LOLBin — Living Off The Land Binary (signed Microsoft binaries used for exfil)
• Dead-drop resolver — Public service (GitHub, Telegram) used as C2 polling point
• Low-and-slow — Exfil cadence kept below detection baseline (1–10 MB/day)
• Double extortion — Exfil + ransomware pattern (Conti, LockBit, BlackCat)
• Air-gap exfil — Out-of-band channels (acoustic, EM, LED) for isolated networks

Scope

This skill covers offensive exfiltration testing for red team engagements:

• Egress validation against DLP / SWG / CASB
• DNS / ICMP / HTTPS / stego / cloud exfil channels
• APT simulation (state actor + cybercrime tradecraft)
• DLP rule validation
• Reporting on detection gaps

Out of scope: data theft (real PII), destructive wipers, mass DoS of egress, production source-of-truth corruption.

Use Cases

• Egress validation: Test whether SWG/CASB catches DNS tunneling, HTTPS beaconing, low-and-slow exfil
• : Validate DLP catches PAN, SSN, MRN, source code, design docs across channels