Data Exfiltration is the technique of transferring unauthorized data out of the network, this is typically why companies have Data Loss Prevention systems in place - to prevent data exfiltration. Unfortunately, Data Loss Prevention systems aren’t perfect and they can allow data that is classified to leave the network. This is where the Security Operations Center comes in.

Part of the job of a SoC Tier 1 Analyst is determine if an attack had actually occurred, this can be identified by many means. An easy way to tell is to review wireshark logs from the network and search for data exfiltration techniques. It’s a lot easier to spot data that you know shouldn’t be leaving the network than to determine if an APT (Advanced Persistent Threat) is inside. APTs can often be hidden deep inside the network, often abusing Kerberos and it’s Ticket Granting System to gain permanent access.

Some Data Exfiltration techniques include:

• DNS
• FTP/SFTP based file transfer
• SMB based file transfer
• HTTP/HTTPS
• Steganographical methods, like hiding data within images
• ICMP
• And many more. The sky's the limit for Exfiltration methods.

DNS is the single most common technique used in Data Exfiltration, mainly because it blends in with normal traffic. DNS is used on just about every single device on your network, and it can be incredibly difficult to determine malicious traffic. An attacker, for example, could have their website setup, listening for data on any subdomain other than www and record it to a file to later examine the contents

Another technique is using photos to transfer data via methods of Steganography. The attacker may embed a hidden file within an image using a utility like Steghide [Note: Must be installed on Kali] (which we can also use to extract the data). If we noticed that a specific IP has requested a specific seemingly random image (like Google’s logo on a website that is not google), we may choose to investigate.

steghide extract -sf ./<file to extract>.jpg