Low-and-Slow Data Exfiltration

Overview

Low-and-Slow Data Exfiltration is a technique used by adversaries to stealthily transfer sensitive data out of a compromised environment over an extended period. By minimizing the volume and frequency of data transmissions, attackers reduce the likelihood of detection by security monitoring systems. This technique is typically employed during the exfiltration phase of the attack lifecycle to evade network defenses and data loss prevention mechanisms.

Attack Objective

• Primary goal: covert theft of data while avoiding detection
• Attack lifecycle stage: Exfiltration
• Advances attacker position by enabling extraction of valuable information without triggering security alerts, facilitating prolonged access and intelligence gathering

How the Technique Works

Adversaries divide large data sets into small chunks and transmit them intermittently or at very low bandwidths, often blending exfiltration traffic with legitimate network activity. This approach avoids generating anomalous spikes in network usage or triggering threshold-based alerts. Data may be encoded, encrypted, or embedded within benign protocols to further obscure its presence during transfer.

Common Methods & Variations

• Use of common protocols such as HTTP, HTTPS, DNS, or email to blend with normal traffic
• Exfiltration via cloud storage services or legitimate third-party platforms
• Endpoint-based exfiltration using scheduled tasks or background processes
• Living-off-the-land techniques leveraging built-in system utilities and legitimate credentials
• Variations include slow data transfer over VPNs, proxy servers, or anonymizing networks

Indicators of Compromise (IOCs)

• Unusual patterns of small, frequent outbound data transfers
• Network traffic with irregular timing or low volume but persistent connections
• Unexpected use of protocols or services for data transmission
• Endpoint logs showing repeated access to sensitive files followed by network activity
• Authentication anomalies related to cloud or external service access

Detection Strategies

• Analysis of network flow data and metadata for low-volume, persistent outbound connections
• Behavioral analytics to identify deviations from normal user or system data transfer patterns
• Correlation of file access events with subsequent network activity
• Use of anomaly detection on DNS queries and HTTP headers
• Integration of endpoint telemetry with network monitoring for comprehensive visibility

Mitigation & Prevention

• Implement data loss prevention (DLP) solutions with sensitivity to low-volume exfiltration
• Enforce strict network segmentation and egress filtering to limit unauthorized outbound connections
• Apply least privilege principles to restrict access to sensitive data and external services
• Monitor and restrict use of system utilities and scripting environments that can facilitate exfiltration
• Regularly update and tune detection rules to identify subtle exfiltration patterns

Response Considerations

• Immediately isolate affected systems to prevent ongoing data leakage
• Conduct thorough investigation correlating file access logs with network traffic to identify scope
• Identify and revoke compromised credentials or tokens used for exfiltration
• Enhance monitoring and implement additional controls to prevent recurrence
• Perform post-incident review to improve detection and response capabilities

Related Techniques

• Data Staged: preparation of data prior to exfiltration
• Command and Control: use of covert channels for communication
• Credential Access: obtaining credentials to facilitate exfiltration
• Defense Evasion: methods to avoid detection during data transfer

Mapping & References

• MITRE ATT&CK Tactic: Exfiltration
• MITRE ATT&CK Technique: Exfiltration Over Alternative Protocol (T1048), Exfiltration Over C2 Channel (T1041)
• Public research on network traffic analysis for low-volume data exfiltration
• Industry advisories on data loss prevention and anomaly detection best practices