Interim data exfiltration

In some situations, during the discovery, attackers may export data of interest to systems under their control. Such actions can be performed not only to reduce the time of active interaction with the victim host and subsequent, more detailed analysis of the data on the side, but also for noisy processing or manipulation of the collected data. For example, adversaries can extract registry files that store information about users and their passwords, or password manager databases for credential harvesting.

There are many different ways to export collected data externally. Threat actors may use a command and control (C2) server as a transmission channel, upload files via file-sharing services or content delivery networks (CDNs), and even send them via messengers and email. We will explore data exfiltration and detection methods more closely in Chapter 9.

It is also worth remembering that both discovery and exfiltration can be cyclical and are closely related...