After social engineering produced account takeover of a finance clerk, the actor used the mailbox for email compromise. Splunk now shows large uploads of tax-roll files to an external host. Which blueprint term names the current stage?

After social engineering produced account takeover of a finance clerk, the actor used the mailbox for email compromise. Splunk now shows large uploads of tax-roll files to an external host. The blueprint term for the current stage is exfiltration of civic data to an external destination. Civic framing matters because tax-roll data is sensitive municipal information; analysts must name the active stage—data leaving—while keeping earlier stages on the timeline without letting them overwrite the live notable.

Calling the current stage social engineering because that was how access began fails by concept: social engineering explains initial human manipulation, not the present bulk upload of files. Labeling it account takeover because the password is still in use fails by concept: takeover describes control of the identity, whereas the new evidence is data movement to an external host. Calling it zero trust because the clerk is on the inside VLAN fails by concept: zero trust is a defensive design principle, not an attack stage and not implied by VLAN placement.

Exam caveat: SPLK-5001 stage questions ask for the current behavior in evidence—prior phish or takeover stay on the kill chain, but large outbound tax-roll transfers are exfiltration.

Operational check: Confirm external destination, volume, and file types in proxy and DLP-like logs, contain the clerk identity and endpoints, notify privacy/legal for tax-roll exposure, and disposition the active stage as exfiltration.