Attack scenario
Data exfiltration and leakage
An adversary searches for, collects, and transfers sensitive data from endpoints, cloud services, email, or internal repositories.
Why this scenario matters
This view connects the attack path with preventive, detective, response, and recovery controls and helps identify gaps between technologies.
The scenario uses MITRE ATT&CK® as a reference model. It is an expert SecTec interpretation and does not imply endorsement by MITRE.
Relevant ATT&CK tactics
- Collection
- Exfiltration
Relevant ATT&CK techniques
- T1005 Data from Local System
- T1020 Automated Exfiltration
- T1041 Exfiltration Over C2 Channel
- T1048 Exfiltration Over Alternative Protocol
- T1052 Exfiltration Over Physical Medium
- T1114 Email Collection
- T1213 Data from Information Repositories
- T1530 Data from Cloud Storage
- T1567 Exfiltration Over Web Service
SecTec technologies and vendors
The following hierarchy is derived from the approved ATT&CK-to-technology and technology-to-vendor mappings.