Data Exfiltration Detection
Data exfiltration is the unauthorized transfer of data from an organization to an external destination controlled by an adversary.
- can be from insider or malware
Data Exfiltration Phases
- Discovery / Collection
- attacker locates sensitive files
- Staging / Compression
- attacker aggregates, compresses, encrypts, or encodes files (ZIP, RAR, 7z, tar, base64, steganography)
- Exfiltration transport
- transfer over network, removable media, cloud, or covert channels
- Command & Control (C2) coordination
- orchestrates transfer and confirms receipt
Techniques and Indicators
- Requires correlating host and network-level indicators such as:
- unusually large or frequent outbound uploads (proxy/firewall)
- long or high-entropy DNS queries
- suspicious process command-lines and network connections (Sysmon/EDR)
- cloud storage API activity
- removable-media events
- SOC L1 triage focuses on:
- source host/user
- destination
- transferred volume
- process identity/command-line
- and supporting evidence across proxy, DNS, flow, host, and cloud logs
| Techniques | Examples | Indicator of Attack & where to look |
|---|---|---|
| Network-based | HTTP/HTTPS uploads to S3/Azure Blob/webmail, FTP/SFTP/SCP, DNS tunnelling, ICMP/covert protocols, custom TCP/UDP. | Proxy/web gateway logs (large POSTs, uploads to cloud endpoints), firewall/NGFW flows (high bytes to single IP/ASN), netflow (spikes/outbound flows), DNS logs (long hostnames, TXT queries). |
| Host-based | Powershell/Invoke-WebRequest, rclone, awscli, curl/wget, archive creation (zip/rar), use of removable USBs, ADS/hidden streams. | Sysmon/EDR (Process Create, Network Connect, File Create events), Windows Security (4663/4656 object access), auditd/shell history on Linux, and removable-media events. |
| Cloud exfiltration | S3 PutObject / multipart upload, Azure Blob uploads, Google Cloud Storage objects. Insert, Drive/SharePoint external sharing. | CloudTrail / Azure Activity / GCP Audit, cloud storage access logs, unusual service-account or IP activity. |
| Covert & encoding | DNS tunnelling, base64 or chunked encoding, steganography into images/audio, splitting files into many small requests (low-and-slow). | DNS logs, proxy logs with many small POSTs, correlation of intermittent uploads + suspicious process activity. |
| Insider & collaboration tools | Slack/Teams/Dropbox/Google Drive/Box uploads or sharing to external users; compromised employee accounts. | Audit logs (share events, file downloads), and mail logs. |
| General IoAs & triage signals | A large outbound volume to external IPs/domains, unknown destination domains, suspicious processes/command lines, many file read events followed by an outbound connection, and multipart/streamed uploads. | Correlate: Proxy/Firewall/Netflow, DNS, Sysmon/EDR (EventID 1/3/11), mail server logs. |
Methods
- Data Exfiltration via DNS Tunneling
- Data Exfiltration via FTP
- Data Exfiltration via HTTP
- Data Exfiltration via ICMP
- Many more
Reference
Shabbir, S. (n.d.). Data Exfiltration Detection. TryHackMe. Retrieved June 9, 2026, from https://tryhackme.com/room/dataexfildetection