<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Detecting Endpoint Data Exfiltration

## Sysmon Events

| Event ID | Description |
|---|---|
| 1 | Process creation (archive tools with -p flag) |
| 3 | Network connection (large outbound transfers) |
| 11 | File create (archive in temp directory) |
| 22 | DNS query (tunneling detection) |

## Cloud Storage Domains

```
drive.google.com, dropbox.com, onedrive.live.com,
mega.nz, file.io, transfer.sh, gofile.io, wetransfer.com
```

## KQL — Outbound Volume

```kql
DeviceNetworkEvents
| summarize TotalBytes=sum(SentBytes) by DeviceName
| where TotalBytes > 10000000
```

## Agent Script

```bash
node agent.js dns-tunneling --log dns_queries.log
node agent.js volume-anomaly --flows netflow.csv --threshold 100
node agent.js staging --log sysmon_events.txt
```
