Data Exfiltration via HTTP

---

Data exfiltration via HTTP is when an attacker moves sensitive data out of a target network using HTTP as the transport. HTTP is commonly abused because it blends with normal web traffic, can traverse firewalls and proxies, and can be obfuscated (encoding, encryption, tunneling). This detection task aims to teach SOC analysts how to identify signs of HTTP-based exfiltration in packet captures (Wireshark) and logs (Splunk), and to provide practical search queries and investigation steps.

Why it matters

• HTTP is very common; attackers hide exfiltration in the noise of legitimate web usage.
• Successful detection stops data breaches and helps trace attacker activity post-compromise.
• Organizations must detect and respond to protect sensitive data and meet compliance requirements.

How adversaries use HTTP for data exfiltration

• POST uploads to external servers: Bulk data is sent to attacker-controlled hosts or cloud storage in POST request bodies.
• GET requests with encoded data: Attacker squeezes small chunks into query strings or path segments (useful for low-and-slow exfiltration).
• Use of common services / CDN: Exfiltration disguised as uploads to popular services or attacker-controlled subdomains under reputable domains.
• Custom headers: Data placed in headers (e.g., X-Data: <base64>) may bypass some string-based DLP.
• Chunked transfer / multipart: Large payloads split into multiple requests to avoid size thresholds.
• HTTPS/TLS tunneling: The encrypted channel hides the payload; detection requires TLS inspection, SNI analysis, or metadata-based detection.
• Staging via cloud services: The attacker uploads to Dropbox/GitHub/Gist and then fetches externally.

Adversaries adapt: low-and-slow approaches, encryption/encoding, and use of legitimate services to evade detection.

Indicators of Attack (IoAs) 

Common network indicators

• Unusually large HTTP POST requests to external/unexpected hosts.
• HTTP requests to domains with low reputation / rarely seen in baseline traffic.
• Frequent small requests (beaconing) to the same host, followed by large uploads.
• Chunked or multipart transfers where multiple requests compose a larger file.

Analyzing Logs with Splunk

• Search for HTTP POST method
• Look at average amount of bytes sent out to various domains
  • e.g., index="data_exfil" sourcetype="http_logs" method=POST | stats count avg(bytes_sent) max(bytes_sent) min(bytes_sent) by domain | sort - count
• Filter out benign traffic and isolate POSTs with large payloads
  • index="data_exfil" sourcetype="http_logs" method=POST bytes_sent > 600 | table _time src_ip uri domain dst_ip bytes_sent | sort - bytes_sent
• Find suspicious entries with large chunks of data uploaded to external source
• Correlate with pcap to extend analysis

Analyze with Wireshark

• Filter HTTP POST requests: http.request.method == "POST"
• Filter for traffic with large frame length
  • e.g., http.request.method == "POST" && frame.len > 700
• Investigate TCP stream