Knowledge is Power
BARE METAL CYBERKnowledge is Power

Sitewide Search

Search Bare Metal Cyber

Search exact control and technique identifiers, Cyber Wiki articles, framework records, playbooks, books, podcasts, Academy courses, individual lessons, and BMC Cyber Challenge activities.

Cyber Wiki Learning Path

MITRE ATT&CK®: Exfiltration

Explore all active Enterprise ATT&CK v19.2 techniques and sub-techniques associated with the Exfiltration objective, with defensive explanations and linked BMC learning resources.

Recommended Sequence

19 connected entries

All learning paths
ATT&CK technique profile · Intermediate

Automated Exfiltration (T1020)

Automated Exfiltration (T1020) is an Enterprise ATT&CK technique associated with Exfiltration. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Data Transfer Size Limits (T1030)

Data Transfer Size Limits (T1030) is an Enterprise ATT&CK technique associated with Exfiltration. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Exfiltration Over Alternative Protocol (T1048)

Exfiltration Over Alternative Protocol (T1048) is an Enterprise ATT&CK technique associated with Exfiltration. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Exfiltration Over Asymmetric Encrypted Non-C2 Protocol (T1048.002)

Exfiltration Over Asymmetric Encrypted Non-C2 Protocol (T1048.002) is an Enterprise ATT&CK sub-technique under Exfiltration Over Alternative Protocol. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.

ATT&CK sub-technique profile · Advanced

Exfiltration Over Bluetooth (T1011.001)

Exfiltration Over Bluetooth (T1011.001) is an Enterprise ATT&CK sub-technique under Exfiltration Over Other Network Medium. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.

ATT&CK technique profile · Intermediate

Exfiltration Over C2 Channel (T1041)

An adversary sends collected data through the same command-and-control channel used to manage compromised systems.

ATT&CK technique profile · Intermediate

Exfiltration Over Other Network Medium (T1011)

Exfiltration Over Other Network Medium (T1011) is an Enterprise ATT&CK technique associated with Exfiltration. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Exfiltration Over Physical Medium (T1052)

Exfiltration Over Physical Medium (T1052) is an Enterprise ATT&CK technique associated with Exfiltration. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Exfiltration Over Symmetric Encrypted Non-C2 Protocol (T1048.001)

Exfiltration Over Symmetric Encrypted Non-C2 Protocol (T1048.001) is an Enterprise ATT&CK sub-technique under Exfiltration Over Alternative Protocol. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.

ATT&CK sub-technique profile · Advanced

Exfiltration Over Unencrypted Non-C2 Protocol (T1048.003)

Exfiltration Over Unencrypted Non-C2 Protocol (T1048.003) is an Enterprise ATT&CK sub-technique under Exfiltration Over Alternative Protocol. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.

ATT&CK technique profile · Intermediate

Exfiltration Over Web Service (T1567)

An adversary uploads information through a web service, cloud-storage provider, code-sharing service, or other internet platform that may resemble normal use.

ATT&CK sub-technique profile · Advanced

Exfiltration Over Webhook (T1567.004)

Exfiltration Over Webhook (T1567.004) is an Enterprise ATT&CK sub-technique under Exfiltration Over Web Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.

ATT&CK sub-technique profile · Advanced

Exfiltration over USB (T1052.001)

Exfiltration over USB (T1052.001) is an Enterprise ATT&CK sub-technique under Exfiltration Over Physical Medium. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.

ATT&CK sub-technique profile · Advanced

Exfiltration to Cloud Storage (T1567.002)

Exfiltration to Cloud Storage (T1567.002) is an Enterprise ATT&CK sub-technique under Exfiltration Over Web Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.

ATT&CK sub-technique profile · Advanced

Exfiltration to Code Repository (T1567.001)

Exfiltration to Code Repository (T1567.001) is an Enterprise ATT&CK sub-technique under Exfiltration Over Web Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.

ATT&CK sub-technique profile · Advanced

Exfiltration to Text Storage Sites (T1567.003)

Exfiltration to Text Storage Sites (T1567.003) is an Enterprise ATT&CK sub-technique under Exfiltration Over Web Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.

ATT&CK technique profile · Intermediate

Scheduled Transfer (T1029)

Scheduled Transfer (T1029) is an Enterprise ATT&CK technique associated with Exfiltration. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Traffic Duplication (T1020.001)

Traffic Duplication (T1020.001) is an Enterprise ATT&CK sub-technique under Automated Exfiltration. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.

ATT&CK technique profile · Intermediate

Transfer Data to Cloud Account (T1537)

Transfer Data to Cloud Account (T1537) is an Enterprise ATT&CK technique associated with Exfiltration. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.