Encrypted Large File Exfiltration

Sensitive data may be collected, placed in an encrypted archive, and transferred to a remote destination. This record currently combines three distinct route choices: an existing C2 channel (T1041), a non-C2 network protocol such as SFTP over SSH (T1048 family), or a web/cloud storage service such as ownCloud (T1567.002). They have different prerequisites and ATT&CK mappings; this entry remains a composite until its scope is split or narrowed. Archiving is a staging step, not the defining exfiltration channel.