<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-data-exfiltration-before-encryption
description: >-
  Detect data exfiltration that precedes ransomware encryption in double
  extortion attacks. Covers monitoring for data staging, unusual outbound
  transfers via rclone/MEGAsync/WinSCP, DNS tunneling, cloud storage
  uploads, and network anomaly detection. Provides Sigma rules, KQL queries,
  and network flow analysis techniques.
domain: cybersecurity
subdomain: ransomware-defense
tags:
  - data-exfiltration
  - double-extortion
  - network-monitoring
  - rclone
  - mega
  - dns-tunneling
  - dlp
  - netflow
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1048"]
---

# Detecting Data Exfiltration Before Encryption

## Overview

Modern ransomware groups exfiltrate data before encrypting — double
extortion. Detection of exfiltration during the staging/transfer phase
is the last high-value detection window before encryption begins. Typical
exfiltration occurs 1-7 days before encryption deployment.

Common exfil tools: rclone, MEGAsync, WinSCP, FileZilla, curl, 7-Zip
staging, and cloud storage APIs.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| Zeek | Network protocol analysis | `apt install zeek` |
| Suricata | Network IDS | `apt install suricata` |
| Rita | Beacon detection | GitHub release |
| ntopng | NetFlow analysis | `apt install ntopng` |
| Sigma CLI | Rule conversion | `pip install sigma-cli` |

## Key Concepts

### Exfiltration Detection Matrix

| Method | Indicator | Detection Source |
|--------|-----------|-----------------|
| rclone to cloud | Process: rclone.exe | Sysmon EID 1 |
| MEGAsync upload | DNS: *.mega.nz | DNS logs |
| Archive staging | Large .7z/.rar creation | File creation events |
| SMB lateral copy | High-volume SMB writes | NetFlow / Zeek |
| DNS tunneling | High DNS query volume | DNS analytics |
| HTTP/S upload | Large outbound POST | Proxy / TLS inspection |
| FTP exfil | FTP data channel | NetFlow |

### Data Staging Indicators

```
Pre-exfiltration staging pattern:
├── 7-Zip/WinRAR used to compress directories
│   └─ CommandLine: 7z.exe a -p[password] archive.7z /data/
├── Archives placed in temp directories
│   └─ C:\Users\*\AppData\Local\Temp\*.7z
├── Archives split into smaller chunks
│   └─ archive.7z.001, archive.7z.002, ...
└── Staging in world-writable shares
    └─ C:\ProgramData\, C:\Windows\Temp\
```

## Workflow

### Step 1 — Detect Exfiltration Tools

```yaml
# Sigma: rclone Execution for Data Exfiltration
title: Rclone Execution - Potential Data Exfiltration
id: a7b3c8d4-2e1f-4a9b-b5c6-7d8e3f2a1b4c
status: stable
description: Detects rclone execution commonly used by ransomware groups for exfiltration
logsource:
  category: process_creation
  product: windows
detection:
  selection_binary:
    Image|endswith: '\rclone.exe'
  selection_renamed:
    CommandLine|contains:
      - '--config'
      - 'copy'
      - 'sync'
      - 'mega'
      - 's3:'
      - 'ftp:'
  condition: selection_binary or selection_renamed
falsepositives:
  - IT administrators using rclone for legitimate cloud sync
level: high
tags:
  - attack.exfiltration
  - attack.t1048
```

```yaml
# Sigma: Large Archive Creation (Data Staging)
title: Large Archive File Created - Data Staging
id: b8c4d9e5-3f2a-4b0c-c6d7-8e9f4a3b2c5d
status: experimental
description: Detects creation of large archive files indicating data staging
logsource:
  category: file_create
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - '.7z'
      - '.zip'
      - '.rar'
      - '.tar.gz'
    TargetFilename|contains:
      - '\Temp\'
      - '\ProgramData\'
      - '\AppData\'
  condition: selection
falsepositives:
  - Legitimate backup operations to temp directories
level: medium
tags:
  - attack.collection
  - attack.t1560.001
```

### Step 2 — Network-Based Exfiltration Detection

```bash
# Zeek — detect large outbound transfers
zeek-cut ts id.orig_h id.resp_h orig_bytes resp_bytes \
  < /var/log/zeek/current/conn.log | \
  awk '$4 > 104857600 {print $0}' | sort -t'	' -k4 -rn

# Suricata rule — rclone user-agent
# alert http any any -> any any (
#   msg:"Rclone User-Agent Detected";
#   http.user_agent; content:"rclone/";
#   classtype:policy-violation; sid:1000001; rev:1;
# )

# Rita — beacon analysis (C2 and exfil detection)
rita import /var/log/zeek/current/ -d investigation
rita show-beacons investigation | head -20
rita show-long-connections investigation | head -20
```

### Step 3 — KQL for Exfiltration Detection

```kql
// Detect unusual outbound data volume per host
DeviceNetworkEvents
| where RemoteIPType == "Public"
| where ActionType == "ConnectionSuccess"
| summarize TotalBytesSent = sum(SentBytes) by DeviceName, bin(Timestamp, 1h)
| where TotalBytesSent > 500000000
| sort by TotalBytesSent desc

// Detect cloud storage uploads
DeviceNetworkEvents
| where RemoteUrl has_any ("mega.nz", "dropbox.com", "onedrive.live.com",
    "drive.google.com", "transfer.sh", "temp.sh", "file.io")
| summarize Uploads = count(), TotalBytes = sum(SentBytes) by
    DeviceName, RemoteUrl, bin(Timestamp, 1h)
| where TotalBytes > 10000000

// Detect DNS tunneling indicators
DeviceEvents
| where ActionType == "DnsQueryResponse"
| extend SubdomainLength = strlen(tostring(split(RemoteUrl, ".")[0]))
| where SubdomainLength > 40
| summarize QueryCount = count() by DeviceName, bin(Timestamp, 10m)
| where QueryCount > 100
```

### Step 4 — Splunk SPL for Data Loss Detection

```spl
| Detect large outbound transfers via firewall
index=firewall action=allowed direction=outbound bytes_out>100000000
| stats sum(bytes_out) as total_bytes by src_ip, dest_ip
| where total_bytes > 500000000
| sort -total_bytes

| Detect rclone or MEGAsync process execution
index=windows sourcetype=WinEventLog:Sysmon EventCode=1
  (Image="*rclone*" OR Image="*MEGAsync*" OR Image="*megacmd*"
   OR CommandLine="*rclone*" OR CommandLine="*mega*")
| table _time, host, User, Image, CommandLine
```

### Step 5 — DNS Exfiltration Detection

```bash
# Analyze DNS query patterns for tunneling
# High entropy subdomain = potential DNS exfil
cat /var/log/zeek/current/dns.log | zeek-cut query | \
  awk -F. '{print length($1), $0}' | sort -rn | head -20

# Count queries per domain (high volume = suspicious)
cat /var/log/zeek/current/dns.log | zeek-cut query | \
  awk -F. '{print $(NF-1)"."$NF}' | sort | uniq -c | sort -rn | head -20
```

## Verification

- [ ] Sigma rules deployed for rclone, MEGAsync, archive staging
- [ ] Network monitoring detects outbound transfers > threshold
- [ ] DNS analytics configured for tunneling detection
- [ ] Cloud storage domain monitoring active
- [ ] Zeek/Suricata processing network traffic
- [ ] Alert playbook for exfiltration indicators tested
- [ ] Baseline established for normal outbound data volumes

## References

- MITRE ATT&CK T1048: Exfiltration Over Alternative Protocol
- MITRE ATT&CK T1567: Exfiltration Over Web Service
- MITRE ATT&CK T1560: Archive Collected Data
- CISA Alert: Ransomware Double Extortion Trends
