In many penetration tests, there’ll be a point where you need to exfiltrate some data. Sometimes this is a situation of “OK, we got the crown jewels, let’s get the data off premise”. Or sometimes in this phase of the test the goal is “let’s make some noise and see if they’re watching for data exfiltration - hmm, nothing yet, let’s make some LOUDER noise and see (and so on)”. As with most things, there’s a spectrum of methods to move the target data out, with various levels of difficulty for detection.
Article Link: https://isc.sans.edu/diary/rss/24354