http://resources.infosecinstitute.com/data-exfiltration-techniques/ I am teaching myself to identify exfiltration of sensitive data with malicious binaries. One thing I have noticed, is in most examples a rather easy spot system call to some sort of http related function is made. Is this true in all cases, or do some malware have a way of hiding their network access routines? How would you spot this? or do malware authors simply not bother? 
Is data exfiltration possible without obvious system calls?
malware