Red › Module 7 › Lesson 3
Exfil Boundaries
Exfiltration literacy with hard boundaries — synthetic $LAB_RT data only, no real PII, RoE-defined channels and stop conditions.
Visual · t21_exfil_boundaries
Exfil = move data out in RoE test. Synthetic only. No real PII. Original Cyberlium.
Opening
Red team may test whether DLP fires on fake crown jewels — exfiltrating real customer records is harm, not homework.
Exfiltration in authorized emulation tests whether data-loss controls detect movement of agreed test artifacts — DNS tunneling concepts, HTTPS upload, cloud storage abuse as named ATT&CK patterns. Cyberlium enforces boundaries: exfil targets and payloads are synthetic files marked $LAB_RT in RoE; volume and destination listed in writing; stop when detection proves or disproves control — NO real PII, NO HR databases, NO scraping stranger SaaS, NO staging stolen breach data as 'sample exfil.' Defenders want proof DLP/SIEM saw the test file — not gigabytes of unauthorized personal data. chmod 600 notes; redact paths; purple outcome is detection gap list.
1. Authorized exfil test (RoE)
RoE names file marker, max size, allowed destination (lab collector), and time window — test DLP/SIEM, not steal.
Use obviously synthetic content — Lorem or ENGAGEMENT_TEST marker — never real customer exports.
Command guide
Try these commands — Authorized exfil test (RoE)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: curl, openssl. Reference sites: Exfiltration boundaries (https://attack.mitre.org/tactics/TA0010/); CISA red team (https://www.cisa.gov/resources-tools/resources/red-team-exercises). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Refused exfil
Real PII, PHI, payment cards, live mailbox archives, stranger database dumps — refused and often illegal.
Exfil to personal cloud outside RoE, torrenting victim data, 'impact proof' with production tables — refused.
3. Defender detections
DLP, egress proxy, DNS analytics, cloud CASB, unusual upload volume — map test to expected alert.
Purple: document whether alert fired; fix rule — do not hide channel from blue.
4. What you ship: exfil boundaries card
RoE exfil allowlist + synthetic file rule + refused real PII list + detection expectation.
5. What you record before the next lesson
Exfil boundaries card path.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Exfiltrate real customer CSV from staging to personal Dropbox 'for realism.'
Right
Exfil boundaries card with synthetic-only rule. Next: Lateral Lab.
Mission: exfil boundaries card
1) Define RoE exfil test in one paragraph. 2) List five refused data types. 3) Write synthetic marker rule. 4) Name two DLP/detection sources.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “When is exfil literacy-only without live test?”
Knowledge Check
APPLY: RoE exfil uses:
Multiple choice
Knowledge Check
APPLY: True or False: Real PII exfil proves red-team impact.
True or False
Knowledge Check
APPLY: Exfil purple goal:
Multiple choice