PLAYBOOKSNETHOSTATTRIBDETECT
← all playbooks
INCIDENT TRIAGE · TIER 2
Data Exfiltration Detected
Outbound data movement found in proxy, DLP, network telemetry, or cloud access logs. Something left your network that shouldn't have. Reconstruct: what left, how, when it started, whether the channel is still active, and where the data was staged before it moved.
reactive · data loss · reconstruct the timeline · regulatory notification trigger
Is the exfiltration channel still active? Before deep investigation, determine if data is still leaving. If the channel is live (ongoing large outbound transfer, active C2 session with file upload, continuous DNS tunneling), block it now. Preserve the evidence in your network capture, then cut the connection. The investigation can use the captured traffic.
Common exfiltration channels

HTTPS to cloud storage. Rclone to Mega, OneDrive, Google Drive, Dropbox, S3. The most common exfil method because it blends with legitimate cloud traffic. Look for: Rclone process execution (Sysmon EID 1), large sustained HTTPS uploads to cloud storage domains, and cloud storage API calls from server infrastructure that doesn't normally use cloud storage.

DNS tunneling. Data encoded in DNS queries to attacker-controlled domains. Low bandwidth but hard to detect without DNS inspection. Indicators: extremely long DNS query names, high query volume to a single domain, query names with encoded or hex data patterns, and TXT record responses with encoded payloads.

C2 channel exfil. Data uploaded through an existing C2 implant (Cobalt Strike download command, custom backdoor file upload). Blends with C2 callback traffic. Identified by: unusually large C2 sessions, C2 session duration spikes, and beacon traffic volume anomalies.

Email-based. Forwarding rules sending copies of email to external addresses, or bulk email with attachments to attacker-controlled mailboxes. Low and slow. Identified by: mailbox rule auditing (see BEC playbook).

Code repository push. Cloning internal repos and pushing to external Git hosting, or uploading source code archives. Developer-focused exfil. Identified by: git push to external remotes, large archive uploads from development infrastructure.

Physical/removable media. USB drives, external hard drives. Air-gapped environments are limited to this channel (see Air-Gapped OT playbook). Identified by: Sysmon EID 11 file creation on removable media, USB mount events.

Triage checklist: exfiltration detected
  1. 1. Characterize the exfiltration channel What protocol, what destination, what volume? Pull the network evidence: proxy logs, firewall logs, DNS logs, Zeek conn.log, Arkime sessions. Identify the destination IP/domain, the protocol (HTTPS, DNS, SSH, SMTP), the total volume transferred, the session duration, and whether it's a single burst or sustained slow exfil. NET: Exfiltration · C2 · Zeek conn.log · Arkime sessions
  2. 2. Identify the source host Which internal host initiated the outbound transfer? The source host is the staging point and likely the last host the attacker had hands-on access to. All subsequent investigation (credential access, lateral movement, data collection) traces backward from this host. NET: source IP from proxy/firewall logs · Zeek conn.log orig_h
  3. 3. Determine when exfiltration started Search historical logs for the first connection to the exfil destination. The first transfer timestamp anchors the timeline: everything before it is staging, everything during is active exfil. Check for earlier smaller test transfers (attackers often test the channel with small files before bulk exfil). Zeek conn.log historical search · DNS logs for first resolution of exfil domain
  4. 4. Identify what data was staged On the source host: check for archive creation (7z, zip, rar, tar) in recent file history (Sysmon EID 11). Check for staging directories (C:\Users\Public, C:\Windows\Temp, /tmp, /dev/shm) containing archives or data dumps. Check for database export tools (SQLULDR2, mysqldump, pg_dump) in process history. The staging artifacts tell you what was collected. HOST: T1003.003 NTDS (if credential dumps were staged) · Sysmon EID 11
  5. 5. Determine what data was accessed before staging The attacker collected data before staging it. Check: file share access logs (EID 5145) for bulk reads from sensitive shares, database query logs for large exports, email access logs (MailItemsAccessed) for bulk mailbox access, and source control logs for repo cloning. Map which data stores were accessed and what was read. Security EID 5145 · NET: Collection
  6. 6. Reconstruct the exfiltration tool What tool was used? Rclone (process name, command line with remote config), MEGAcmd, curl/wget with POST data, PowerShell Invoke-WebRequest, Python scripts, certutil -encode for file encoding, or the C2 framework's built-in upload. The tool choice can help with attribution and reveals whether the attacker used custom tooling or commodity tools. HOST: Execution · Sysmon EID 1 command line
  7. 7. Check for encrypted or encoded data Attackers often encrypt or encode staged data before exfiltration: password-protected archives (7z -p, zip -e), base64 encoding (certutil -encode), or custom encryption. If the staged archives are password-protected, you may be able to determine the contents from the collection phase logs (what files were read) even if you can't decrypt the archive. HOST: Defense Evasion
  8. 8. Check for additional exfiltration channels The channel you detected may not be the only one. Search for other anomalous outbound patterns from the same source host and from other compromised hosts: unusual DNS query volumes, sustained HTTPS to cloud storage, SSH/SCP to external IPs, SMTP with large attachments, and any outbound connection to IPs/domains associated with the attacker's C2 infrastructure. NET: Exfiltration · Zeek dns.log + conn.log correlation
  9. 9. Determine the total volume of data lost Sum all outbound transfer volumes to the exfiltration destination across all sessions. Check for: multiple sessions to the same destination over time (slow exfil), transfers from multiple source hosts to the same destination (parallel exfil), and transfers to multiple destinations (redundant exfil). The total volume informs the regulatory notification and damage assessment. Zeek conn.log: sum(orig_bytes) grouped by dest · Proxy logs: total upload volume
  10. 10. Assess regulatory notification obligations If PII, PHI, financial data, or classified information was exfiltrated, regulatory notification timelines apply: GDPR (72 hours), HIPAA (60 days), state breach notification laws (varies, 30-90 days), and sector-specific requirements (CMMC, PCI-DSS, NERC CIP). The data classification from steps 4-5 determines which regulations apply. Legal counsel should be involved before notification decisions.
Exfiltration is usually the last step before impact. In espionage operations (APT29, APT41), exfil is the objective: once the data is out, the mission is complete. In ransomware operations, exfil happens days before encryption. If you detect exfiltration, check whether ransomware deployment is imminent: Ransomware playbook.
Related playbooks

Ransomware Detected (exfiltration precedes encryption in 70%+ of modern ransomware)
C2 Beacon Found (the C2 channel is often the exfil channel)
Business Email Compromise (email forwarding rules as exfil)
Air-Gapped OT (USB/removable media as the only exfil path)