hunting-for-data-exfiltration-indicators

name	hunting-for-data-exfiltration-indicators
description	Hunt for data exfiltration through network traffic analysis, detecting unusual data flows, DNS tunneling, cloud storage uploads, and encrypted channel abuse. Use when hunting for data exfiltration through network traffic analysis, detecting unusual.
domain	cybersecurity
tags	["threat-hunting","mitre-attack","data-exfiltration","dlp","network-analysis","proactive-detection"]
subdomain	threat-hunting
version	1.0
author	oyi77
license	Apache-2.0
atlas_techniques	["AML.T0024","AML.T0056"]
nist_ai_rmf	["MEASURE-2.7","MAP-5.1","MANAGE-2.4"]
d3fend_techniques	["File Metadata Consistency Validation","Certificate Analysis","Application Protocol Command Analysis","Content Format Conversion","File Content Analysis"]
nist_csf	["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"]

Hunting For Data Exfiltration Indicators

Overview

Cybersecurity skill for hunting for data exfiltration indicators. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "hunting for data exfiltration indicators"

• "Hunt for data exfiltration through network traffic analysis, detecting unusual d"

• When hunting for data theft in compromised environments

• After detecting unusual outbound data volumes or patterns

• When investigating potential insider threat data theft

• During incident response to determine what data was stolen

• When threat intel indicates data exfiltration campaigns targeting your sector

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Network proxy/firewall logs with byte-level data transfer metrics
• DLP solution or CASB with cloud upload visibility
• DNS query logs for DNS exfiltration detection
• Email gateway logs for attachment monitoring
• SIEM with data volume anomaly detection capabilities

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}

1. Define Detection Scope — Identify the specific techniques or indicators to hunt. Map to MITRE ATT&CK tactics/techniques where applicable.