Menu
通过网络流量分析狩猎数据外泄行为，检测异常数据流、DNS 隧道、云存储上传以及加密通道滥用。
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/killvxk/cybersecurity-skills-zh --skill hunting-for-data-exfiltration-indicatorsThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Showing SKILL.md
Based on SOC occupation classification
| name | hunting-for-data-exfiltration-indicators |
| description | 通过网络流量分析狩猎数据外泄行为，检测异常数据流、DNS 隧道、云存储上传以及加密通道滥用。 |
| domain | cybersecurity |
| subdomain | threat-hunting |
| tags | ["threat-hunting","mitre-attack","data-exfiltration","dlp","network-analysis","proactive-detection"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| 概念 | 描述 |
|---|---|
| T1041 | 通过 C2 通道外泄数据 |
| T1048 | 通过替代协议外泄数据 |
| T1048.001 | 通过对称加密非 C2 通道外泄 |
| T1048.002 | 通过非对称加密非 C2 通道外泄 |
| T1048.003 | 通过未加密/混淆非 C2 通道外泄 |
| T1567 | 通过 Web 服务外泄数据 |
| T1567.002 | 外泄至云存储 |
| T1052 | 通过物理介质外泄 |
| T1029 | 定时传输 |
| T1030 | 数据传输大小限制（暂存） |
| T1537 | 转移数据至云账户 |
| T1020 | 自动化外泄 |
| 工具 | 用途 |
|---|---|
| Splunk | 数据量分析与 SPL 查询的 SIEM |
| Zeek | 用于数据流分析的网络元数据 |
| Microsoft Defender for Cloud Apps | 云外泄检测的 CASB |
| Netskope | 云 DLP 与外泄检测 |
| Suricata | 协议异常检测的网络 IDS |
| RITA | DNS 外泄与信标检测 |
| ExtraHop | 数据流分析的网络流量分析 |
狩猎 ID：TH-EXFIL-[日期]-[序号]
外泄通道：[HTTP/DNS/邮件/云/USB]
来源：[主机/用户]
目标：[域名/IP/服务]
数据量：[字节/MB/GB]
时间段：[开始 - 结束]
协议：[HTTPS/DNS/SMTP/SMB]
涉及文件：[数量/类型]
风险等级：[严重/高/中/低]
置信度：[高/中/低]