<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Testing Data Exfiltration Detection

## Exfiltration Techniques (ATT&CK)

| Technique | ID | Detection |
|---|---|---|
| Exfil Over DNS | T1048.001 | DNS query volume/length anomaly |
| Exfil Over HTTPS | T1048.002 | SSL inspection, upload anomaly |
| Exfil Over Email | T1048.003 | Email gateway DLP |
| Exfil to Cloud Storage | T1567.002 | CASB, cloud API monitoring |
| Exfil Over C2 | T1041 | Beacon analysis |

## Network Analysis Tools

| Tool | Command | Purpose |
|---|---|---|
| tshark | `tshark -r <pcap> -Y dns -T fields -e dns.qry.name` | Extract DNS queries |
| zeek | `zeek -r <pcap> local` | Generate connection/dns logs |
| suricata | `suricata -r <pcap> -S rules.rules` | Run IDS rules |

## Agent Script

```bash
# Setup listener
node agent.js setup-listener --type http --port 8443 --output listeners.json

# Run exfil tests
node agent.js run-exfil-tests --channels dns,http,cloud \
  --data-size 1024 --output results.json

# Check SIEM detections
node agent.js check-detections --results results.json \
  --siem-url https://splunk:8089 --output detections.json

# Analyze PCAP
node agent.js analyze-pcap --pcap capture.pcap --output analysis.json
```
