🐢 Exfiltration Data Maze

VPC tarpit routing throttling exfiltration to 1 byte/sec.

→ Explore in ATT&CK matrix (6 mappings) Deployment detail

What it is

A response that steers a suspect host's outbound traffic through a throttling proxy instead of blocking it. Exfiltration slows to a crawl while the attacker's session stays open to be observed. The proxy logs destinations, volumes and timing; because a wrong trigger affects a real host, it needs analyst approval and a time limit.

Implementation requirements

When a host is suspected of exfiltration, steer its outbound traffic through a throttling proxy or tarpit instead of blocking it outright. This slows the transfer while keeping the attacker's session alive for observation
Implement through egress controls you already own: an egress proxy policy, a route-table or firewall change, or an SDN redirect (D062)
Monitoring: the proxy logs destinations, volumes and timing, which become evidence for the investigation
Safety: this is a T3 (Active Engage) response with real impact if the trigger is wrong. Require analyst approval, a time limit and a tested rollback, and never throttle shared infrastructure (NAT gateways, proxies serving many hosts) for one host's sake
Rollback: Remove the redirect at the time limit or on analyst decision. Confirm the host's normal egress is restored.
Upkeep: Rehearse the redirect and its rollback in a lab quarterly.

Technologies

Network

ATT&CK coverage 6

Technique	Tactic	Status	Confidence	Tier
T1029 Scheduled Transfer	Exfiltration	theoretical	weak	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1029 Scheduled Transfer as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1029 to its Lures activity. Only repeated pulls of decoy data are seen, not the schedule.
↳ Tarpit research extrapolated to exfiltration timing; unvalidated in this context.
T1030 Data Transfer Size Limits	Exfiltration	theoretical	weak	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1030 Data Transfer Size Limits as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1030 to its Lures activity. Only chunked pulls of decoy data are seen.
↳ Tarpit research extrapolated to transfer-size analysis; unvalidated in this context.
T1041 Exfiltration Over C2 Channel	Exfiltration	theoretical	weak	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1041 Exfiltration Over C2 Channel as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1041 to its Lures activity. The data maze sees bulk collection, not the C2 channel.
↳ Tarpit research extrapolated to C2 exfiltration; unvalidated in this context.
T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Exfiltration	theoretical	weak	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol as an adversary behaviour. Exfiltration goes to the attacker's own server.
T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol	Exfiltration	theoretical	weak	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol as an adversary behaviour. Exfiltration goes to the attacker's own server.
T1567.002 Exfiltration to Cloud Storage	Exfiltration	theoretical	weak	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1567.002 Exfiltration to Cloud Storage as an adversary behaviour. Exfiltration goes to the attacker's own storage.

Evidence

Three Decades of Deception Techniques in Active Cyber Defense — Retrospect and Outlook — Zhang, L.; Thing, V. L. L., arXiv:2104.03594 2021 peer-reviewed
LaBrea: "Sticky" Honeypot and IDS (project page) — Liston, T., 2001 industry
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard