Insufficient Egress Filtering: How Weak Outbound Controls Enable Attacks

### Executive Summary This guidance document explains risks from insufficient egress filtering, provides testing procedures (outbound TCP/ICMP checks), and details common attacker abuse techniques such as SSH tunnels for C2, covert ICMP/DNS channels, and outbound SMB-based credential theft and relay; it emphasizes restricting outbound ports/protocols and monitoring to reduce attack surface and detection workload.