Windows:
Data Exfiltration
Guides on staging, and exfiltrating data over HTTP, SMB, FTP, and DNS
Windows Data Discovery and Staging
Techniques for identifying, collecting, and staging sensitive Windows data prior to exfiltration, covering file enumeration, compression, and archiving methods.
Windows DNS and Covert Channel Exfiltration
Explores DNS-based covert channel techniques on Windows to exfiltrate data, bypassing network controls by encoding payloads within DNS query traffic.
Windows Exfiltration over HTTP and HTTPS
Covers techniques for exfiltrating data from Windows systems via HTTP/HTTPS, including tools, methods, and detection strategies for outbound data theft.
Windows Exfiltration over SMB and FTP
Covers techniques for exfiltrating data from Windows systems via SMB shares and FTP transfers, including tools, commands, and detection evasion methods.
Windows data exfiltration covers staging and transferring files from compromised Windows hosts. The choice of method depends on what is available on the target and what outbound traffic the network allows. SMB shares, PowerShell download cradles (Invoke-WebRequest, System.Net.WebClient), certutil with base64-encoded files, and bitsadmin transfers each have different detection profiles.
When HTTP and SMB are blocked, DNS tunneling with dnscat2, ICMP exfil, and even clipboard abuse through RDP sessions become viable alternatives. For large datasets, compression and splitting with built-in tools (Compress-Archive, makecab) reduces transfer volume and avoids size-based alerts.
The subpages cover each transfer method with practical commands, discuss which techniques trigger common EDR detections, and walk through staging strategies that minimize time-on-disk for sensitive data.