Introduction to exfiltration

- [Instructor] In the Lockheed Martin Cyber Kill Chain model…of a cyberattack, data exfiltration is one…of the possible actions taken in the final stage…of the attack.…Exfiltration covers the automated actions taken…by malware to send data out…to the attacker's collection point,…and it covers manual techniques used…by an intruder to pull data back from an attack session.…One of the main ways to detect a cyberattack is…to identify the data being exfiltrated,…and so, concealment is an important characteristic…of any serious exfiltration technique.…

This is particularly important…where documents being exfiltrated are classified.…It may trigger alarms if classification…markings are detected on the network.…Detecting sensitive data isn't the only way…exfiltration alarms can be set off.…The protocols used may trigger alarms either on their own…or when correlated with the packet destinations,…and so, exfiltration may need to be camouflaged.…Attacks will often try to understand the network traffic…and then hide exfiltration in plain sight…