What Is Data Exfiltration?
Last verified on Nov 8, 2026.
Data exfiltration is the unauthorized transfer of information from a system. That is NIST's definition of exfiltration, and it is deliberately plain. The data has to leave. An attacker who reads a database has breached it. An attacker who copies the contents to a server they control has exfiltrated it.
In the ATT&CK model it is a late stage: once adversaries have collected data, they often package it to avoid detection while removing it. ATT&CK says that can include compression and encryption, and that data typically leaves over the attacker's command and control channel or an alternate channel, sometimes with size limits on the transmission.
Methods
ATT&CK's Exfiltration tactic (TA0010) lists these routes among others:
Two points follow. ATT&CK notes that popular web services give cover because hosts are likely already talking to them and firewall rules may already permit them, so the destination alone may not look bad. And size limits and schedules exist to avoid network transfer threshold alerts, so a single big-transfer alert is not enough.
What It Looks Like in Logs
No single log shows it. You see it at three layers:
Network. VPC flow log records in the default format include source and destination address, ports, protocol, packets, and bytes. A host that normally sends little suddenly sending many bytes to an external address stands out. An illustrative record (fields in default order, ending with action and status):
2 123456789010 eni-0a1b2c3d4e5f60718 10.0.3.25 198.51.100.77 44310 443 6 48211 61882004 1794103200 1794103800 ACCEPT OKAbout 61 MB in ten minutes over HTTPS from an internal host, to an address it has never talked to, is worth a look.
Storage. Bulk reads of objects. In AWS, S3 object-level operations such as GetObject are CloudTrail data events, and by default trails do not log data events. If you have not enabled them, a copy of a whole bucket leaves no CloudTrail record of the objects read.
Application. Exports, report downloads, and API calls with large page sizes. ATT&CK's detection ideas for web-service exfiltration include abnormal upload, create, or copy operations from compromised accounts in audit logs, and high outbound-to-inbound ratios from processes that normally make few connections.
Questions to ask:
- Did this actor or host move more data out than it ever has?
- Where did it go, and has this source ever sent there before?
- What came just before: a new login, a privilege change, a burst of reads?
- Is the volume low and steady, designed to stay under a threshold? Sum over a day, not just per event.
The working queries are in detecting unusual data egress. Egress is usually the last event in a chain that began with account takeover or privilege escalation, and often includes lateral movement in between.
Reducing the Risk
- Log the right layers before you need them. Enable object-level logging for sensitive storage and flow logs for the networks that hold it.
- Narrow outbound paths. Egress filtering and allowlists for servers that should only talk to a few places make odd destinations obvious.
- Scope credentials. An identity that can read one bucket cannot copy all of them.
- Limit what exports can contain. Cap rows and page sizes, and require re-authentication for bulk export.
- Know what is sensitive. You cannot measure a leak of data you have not classified.
In Sazabi
Sazabi, an AI-native observability and security platform, can create and stream VPC flow logs for the VPCs you choose, giving you the network layer in the same place as your application logs. For the larger picture of what to watch, see security issues and novel events.
Frequently Asked Questions
What is data exfiltration?
The unauthorized transfer of information from a system. NIST defines exfiltration that way. It is the step in an attack where stolen data actually leaves your environment.
What are common data exfiltration methods?
Sending data over the attacker's command and control channel, uploading to an external web service or a cloud account the attacker controls, using a different protocol than the main channel, and scheduled or size-limited transfers meant to avoid notice.
Is data exfiltration the same as a data breach?
No. A breach is the broader event of unauthorized access to data. Exfiltration is the specific movement of data out. Data can be exposed to an attacker without necessarily having left your environment.
What logs show data exfiltration?
Network flow logs for large outbound transfers, object storage access logs for bulk reads, application audit logs for exports and downloads, and DNS and proxy logs for unusual destinations.
Sources
- NIST glossary defines exfiltration as the unauthorized transfer of information from a system (SP 800-53 Rev. 5) (accessed Nov 8, 2026)
- ATT&CK TA0010 Exfiltration: techniques to steal data from your network, often packaging it with compression and encryption, over the command and control channel or an alternate channel, possibly with size limits; techniques include Exfiltration Over Web Service, Over Alternative Protocol, Over C2 Channel, Transfer Data to Cloud Account, Data Transfer Size Limits, Scheduled Transfer (accessed Nov 8, 2026)
- ATT&CK detection for exfiltration over web services: high outbound-to-inbound data ratios, archiving followed by encrypted uploads to external services, and abnormal upload, create, or copy operations from compromised accounts in audit logs (accessed Nov 8, 2026)
- By default CloudTrail trails and event data stores do not log data events; S3 object-level operations such as GetObject are data events (accessed Nov 8, 2026)
- The default VPC flow log format has version 2 fields including source and destination address, ports, protocol, packets, and bytes (accessed Nov 8, 2026)
- Sazabi creates a flow log for each VPC you pick and streams its network traffic data (accessed Nov 8, 2026)