Exfiltration via File-Sharing Platform

The subject uploads organizational data to a personal or unauthorized file-sharing platform (e.g., Dropbox, Google Drive, WeTransfer, MEGA, or similar) to remove it from controlled environments. This technique is commonly used to bypass endpoint restrictions, avoid detection by traditional DLP systems, and facilitate remote access to stolen data. Uploads may occur through browser sessions, desktop clients, or command-line tools, depending on the sophistication of the subject and the controls in place.

Investigators should evaluate whether the data transferred was sensitive, proprietary, or otherwise restricted, and assess whether the subject attempted to conceal or stage the transfer using obfuscation or anti-forensics techniques.