After discovering valuable information and collecting it from across the environment, a threat actor reaches one of the most important stages of the attack: getting that data out. Data exfiltration is often the ultimate objective of an intrusion, whether the attacker is motivated by financial gain, espionage, or extortion. Until the data leaves the victim's environment, the attacker has not achieved their main goal.

Unlike earlier phases of an attack, data exfiltration requires threat actors to move stolen data without attracting attention. To do this, they often abuse legitimate cloud storage providers, trusted web services, and other common tools that blend in with normal activity.

In this room, we'll explore how threat actors abuse tools such as rclone, MEGAsync, and legitimate web services to exfiltrate stolen data. You'll learn the forensic artifacts these techniques leave behind, how to detect them, and finish with practical investigations!

Learning Objectives

• Understand why data exfiltration is a critical phase of the attack lifecycle.
• Explore common techniques attackers use to exfiltrate stolen data.
• Learn how tools such as rclone and MEGAsync are abused to steal data.
• Identify detection opportunities using logs and DFIR artifacts.
• Investigate real-world data exfiltration activity through hands-on practical exercises.

Prerequisites

We suggest completing the following rooms before proceeding:

• Investigating Data Discovery
• Analysing Data Collection
• Uncovering Attacker Infrastructure