CoreQ Academy5.3 Summarize concepts related to staging and exfiltration.
Testers often prove impact by showing data could leave, usually with harmless sample data. Defenders use these results to tune DLP and egress monitoring.
Staging
- File encryption and compression
- Packing data to reduce size and hide contents from inspection.
- Alternate data streams
- NTFS feature that hides data inside another file's stream.
- Virtual drive mounting
- Mounting image files or remote drives to stage data.
Covert channels
- Covert channel
- Hiding data inside allowed communications.
- Steganography
- Hiding data inside images or other media.
- DNS
- Encoding data in DNS queries (DNS tunnelling). Detect long, random subdomains and high query volumes.
- Internet Control Message Protocol (ICMP)
- Hiding data in ping payloads.
- HTTPS
- Blending exfiltration into encrypted web traffic.
Destinations
- Sending data as attachments.
- Cross-account resources
- Copying data to a different cloud account the attacker controls.
- Cloud storage
- Uploading to file-sharing or storage services.
- Text storage sites
- Paste sites used to drop data.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 5.3 of the publicly available CompTIA PenTest+ PT0-003 exam objectives (Exam objectives V3, document version 5.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.