Windows:

Data Exfiltration

Guides on staging, and exfiltrating data over HTTP, SMB, FTP, and DNS

4 guides • Created Apr 4, 2026 • Updated Apr 4, 2026

4 guides

Windows Data Discovery and Staging

Techniques for identifying, collecting, and staging sensitive Windows data prior to exfiltration, covering file enumeration, compression, and archiving methods.

Apr 4, 2026 • 5 min read

Windows DNS and Covert Channel Exfiltration

Explores DNS-based covert channel techniques on Windows to exfiltrate data, bypassing network controls by encoding payloads within DNS query traffic.

Apr 4, 2026 • 3 min read

Windows Exfiltration over HTTP and HTTPS

Covers techniques for exfiltrating data from Windows systems via HTTP/HTTPS, including tools, methods, and detection strategies for outbound data theft.

Apr 4, 2026 • 3 min read

Windows Exfiltration over SMB and FTP

Covers techniques for exfiltrating data from Windows systems via SMB shares and FTP transfers, including tools, commands, and detection evasion methods.

Apr 4, 2026 • 5 min read

Windows data exfiltration covers staging and transferring files from compromised Windows hosts. The choice of method depends on what is available on the target and what outbound traffic the network allows. SMB shares, PowerShell download cradles (Invoke-WebRequest, System.Net.WebClient), certutil with base64-encoded files, and bitsadmin transfers each have different detection profiles.

When HTTP and SMB are blocked, DNS tunneling with dnscat2, ICMP exfil, and even clipboard abuse through RDP sessions become viable alternatives. For large datasets, compression and splitting with built-in tools (Compress-Archive, makecab) reduces transfer volume and avoids size-based alerts.

The subpages cover each transfer method with practical commands, discuss which techniques trigger common EDR detections, and walk through staging strategies that minimize time-on-disk for sensitive data.