<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-data-exfiltration
description: >-
  Detect data exfiltration attempts across network, endpoint, and cloud
  channels using traffic analysis, DNS inspection, behavioral anomaly
  detection, and volumetric thresholds mapped to MITRE ATT&CK T1048.
domain: cybersecurity
subdomain: data-security
tags:
  - data-exfiltration
  - threat-detection
  - network-analysis
  - dns-tunneling
  - mitre-attack
  - siem
  - ndr
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1020", "T1030", "T1041", "T1048", "T1052", "T1567"]
---

# Detecting Data Exfiltration

## Overview

Data exfiltration is the unauthorized transfer of data from an organization.
Attackers use covert channels — DNS tunneling, HTTPS to cloud storage, steganography,
encrypted archives to personal email — to bypass traditional controls. This skill
covers detection through network traffic analysis, DNS query inspection, endpoint
telemetry, and volumetric anomaly detection mapped to MITRE ATT&CK Exfiltration
techniques (TA0010).

Mode: `[MODE: BLUE]` — Exfiltration detection and threat hunting.

## Prerequisites

- Network flow data (NetFlow/IPFIX) or full packet capture
- DNS query logs (passive DNS or resolver logs)
- SIEM with correlation capabilities
- Endpoint telemetry (EDR agent with file access logging)
- Baseline of normal data transfer volumes per user/system

## Key Concepts

### Exfiltration Channels (MITRE ATT&CK TA0010)

| Technique | ATT&CK ID | Detection Signal |
|-----------|-----------|-----------------|
| Exfil over C2 channel | T1041 | Beaconing patterns, unusual upload volume |
| Exfil over alt protocol | T1048 | DNS tunneling, ICMP data, non-standard ports |
| Exfil over web service | T1567 | Uploads to cloud storage (Mega, Dropbox) |
| Exfil over physical | T1052 | USB mass storage events, MTP connections |
| Automated exfiltration | T1020 | Scheduled large transfers, cron-based uploads |
| Transfer size limits | T1030 | Chunked transfers below detection thresholds |

### DNS Tunneling Detection

```bash
# Detect DNS tunneling indicators
# High entropy subdomain queries
# Unusual TXT/NULL record queries
# High query volume to single domain

# Zeek DNS log analysis
cat dns.log | zeek-cut query qtype | \
  awk '{print length($1), $0}' | sort -rn | head -20

# Entropy calculation for DNS queries
node scripts/agent.js --action dns-entropy --input /var/log/dns.log \
  --threshold 3.5 --output /tmp/dns_exfil.json
```

### Network Volumetric Analysis

```bash
# Detect unusual outbound data volumes
node scripts/agent.js --action volume --input /var/log/netflow.json \
  --baseline-mb 100 --output /tmp/volume_anomalies.json

# Scan for known exfiltration indicators
node scripts/agent.js --action scan --input /var/log/proxy.log \
  --output /tmp/exfil_findings.json
```

## Workflow

### Step 1: Establish Transfer Baselines

Profile normal outbound data volumes per user, system, and destination.

### Step 2: Deploy Detection Rules

```bash
node scripts/agent.js --action scan --input /var/log/proxy.log \
  --output /tmp/exfil_findings.json
```

### Step 3: Analyze DNS for Covert Channels

```bash
node scripts/agent.js --action dns-entropy --input /var/log/dns.log \
  --threshold 3.5 --output /tmp/dns_exfil.json
```

### Step 4: Correlate and Investigate

Cross-reference findings with endpoint telemetry and user activity.

## Detection

```yaml
title: Data Exfiltration Detection
id: 54960802-2ea2-4042-a804-8465ef7255e2
status: experimental
description: Detects suspicious activity related to detecting data exfiltration techniques in data security context
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename: "*suspicious*"
  condition: selection
level: medium
tags:
  - attack.t1020
  - attack.t1030
  - attack.t1041
  - attack.t1048
  - attack.t1052
  - attack.t1567
  - attack.exfiltration
falsepositives:
  - Data loss prevention tools scanning files during classification
```

## Verification

- [ ] DNS tunneling detection rules deployed and tested
- [ ] Volumetric anomaly baselines established per segment
- [ ] Cloud upload destinations monitored (Mega, Dropbox, personal drives)
- [ ] USB mass storage events logged and alerted
- [ ] SIEM correlation rules active for multi-channel exfiltration
- [ ] Sigma rules deployed for exfiltration TTPs
- [ ] Regular purple team validation of detection coverage

## References

- [MITRE ATT&CK TA0010 — Exfiltration](https://attack.mitre.org/tactics/TA0010/)
- [SANS — Detecting DNS Tunneling](https://www.sans.org/white-papers/detecting-dns-tunneling/)
- [NIST SP 800-53 SI-4 — System Monitoring](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)
