<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Detecting Data Exfiltration Before Encryption — API Reference

## Zeek Network Analysis

```bash
# Large outbound connections
zeek-cut ts id.orig_h id.resp_h orig_bytes < conn.log | \
  awk '$4 > 104857600' | sort -t'	' -k4 -rn

# DNS query analysis
zeek-cut query < dns.log | sort | uniq -c | sort -rn | head -20

# File extraction from pcap
zeek -r capture.pcap frameworks/files/extract-all-files
```

## Suricata Rules

```yaml
# Detect rclone user-agent
alert http any any -> any any (
  msg:"Rclone User-Agent - Potential Exfiltration";
  http.user_agent; content:"rclone/";
  classtype:policy-violation; sid:2100001; rev:1;)

# Detect MEGA uploads
alert tls any any -> any any (
  msg:"MEGA.nz TLS Connection - Potential Exfiltration";
  tls.sni; content:"mega.nz";
  classtype:policy-violation; sid:2100002; rev:1;)
```

## Rita Beacon Detection

```bash
# Import Zeek logs
rita import /var/log/zeek/current/ -d case01

# Show beaconing connections (C2 + exfil)
rita show-beacons case01

# Show long-duration connections
rita show-long-connections case01

# Show DNS analysis
rita show-exploded-dns case01
```

## NetFlow Analysis

```bash
# nfdump — top talkers by bytes
nfdump -R /var/log/netflow/ -s srcip/bytes -n 20

# Filter for outbound > 100MB
nfdump -R /var/log/netflow/ "bytes > 100000000 and dst net not 10.0.0.0/8"
```

## Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `threshold_gb` | Outbound volume alert threshold | `1.0` |
| `entropy_threshold` | DNS subdomain entropy threshold | `3.5` |
| `min_archive_size` | Staging archive minimum size | `50MB` |
| `cloud_domains` | Monitored cloud storage domains | `mega.nz, dropbox.com` |
