APT Exfiltration Method Reference

APTs use distinctive exfiltration methods designed to avoid DLP controls and volume-threshold alerts. This reference covers how each method works, what it looks like in your logs, and the detection query to catch it.