hunting-for-data-exfiltration-indicators

name	hunting-for-data-exfiltration-indicators
description	Hunt for data exfiltration through network traffic analysis, detecting unusual data flows, DNS tunneling, cloud storage uploads, and encrypted channel abuse.
domain	cybersecurity
subdomain	threat-hunting
tags	["threat-hunting","mitre-attack","data-exfiltration","dlp","network-analysis","proactive-detection"]
version	1.0
author	mahipal
license	Apache-2.0
atlas_techniques	["AML.T0024","AML.T0056"]
nist_ai_rmf	["MEASURE-2.7","MAP-5.1","MANAGE-2.4"]
d3fend_techniques	["File Metadata Consistency Validation","Certificate Analysis","Application Protocol Command Analysis","Content Format Conversion","File Content Analysis"]
nist_csf	["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"]

Hunting for Data Exfiltration Indicators

When to Use

• When hunting for data theft in compromised environments
• After detecting unusual outbound data volumes or patterns
• When investigating potential insider threat data theft
• During incident response to determine what data was stolen
• When threat intel indicates data exfiltration campaigns targeting your sector

Detection Gaps & Validation

• "Low and slow" defeats volume thresholds: T1030 size-limited transfers and T1029 scheduled exfil stay under daily-byte baselines — sum bytes-out per destination over 7–30 days and alert on cumulative volume, not single sessions.
• DNS tunneling (T1048.003): encoded data in long/high-entropy subdomains and high TXT query rates needs DNS logs (Sysmon EID 22 or resolver logs) plus entropy/length scoring — invisible if only NXDOMAIN or aggregated DNS is retained.
• Encrypted upload blind spots: HTTPS POSTs to personal cloud (T1567.002 — Drive/Dropbox/OneDrive) look like normal TLS; without CASB/DLP body inspection you only have bytes-out + destination — pivot on a high out:in byte ratio and newly-seen destinations.
• Direction matters: flag asymmetric flows where bytes_out >> bytes_in to non-corporate ASNs; many rules only watch inbound.
• Validate: run Atomic Red Team T1048 (DNS/ICMP exfil) and T1567.002 (cloud upload) and confirm the volume-anomaly and DNS-entropy searches fire with the test host/destination.
• Tune FPs: backups, cloud sync (OneDrive/Box), software updates, and video uploads create large legitimate egress — baseline per-user/per-host to sanctioned destinations and exclude known backup targets.

Prerequisites

• Network proxy/firewall logs with byte-level data transfer metrics
• DLP solution or CASB with cloud upload visibility
• DNS query logs for DNS exfiltration detection
• Email gateway logs for attachment monitoring
• SIEM with data volume anomaly detection capabilities

Workflow

1. Define Exfiltration Channels: Identify potential channels (HTTP/S uploads, DNS tunneling, email attachments, cloud storage, removable media, encrypted protocols).
2. Baseline Normal Data Flows: Establish baseline outbound data transfer volumes per user, host, and destination over a 30-day window.
3. Detect Volume Anomalies: Identify hosts or users transferring significantly more data than baseline to external destinations.