Data Exfiltration Hunting
FreeProactively detect data theft through network analysis.
Free · Opens the source repo
What Data Exfiltration Hunting does
The Data Exfiltration Hunting skill is designed for cybersecurity professionals who need to identify and mitigate data theft in compromised environments. By analyzing network telemetry from tools like Zeek and Suricata, this skill enables users to detect unusual data flows, DNS tunneling, and unauthorized uploads to personal cloud storage. It leverages threat intelligence to correlate suspicious activities with known malicious domains, providing a comprehensive approach to threat hunting.
This skill is particularly useful during incident response scenarios where understanding the scope of data exfiltration is critical. It guides users through a structured workflow that begins with defining potential exfiltration channels and establishing baseline data transfer metrics. By identifying anomalies in data flow, users can pinpoint hosts or users that are transferring excessive amounts of data, which may indicate a breach. Furthermore, the skill allows for detailed analysis of transfer destinations, helping to uncover malicious intent behind data movements.
The skill requires several prerequisites, including network logs, DLP solutions, and SIEM capabilities, ensuring that users have the necessary data to effectively hunt for indicators of compromise. The output format provides a clear and concise report of findings, which aids in documenting evidence and recommending containment actions. This makes it an invaluable tool for security teams focused on proactive detection and incident response.
Overall, this skill is tailored for security analysts and incident responders who need to stay ahead of potential data exfiltration threats and respond effectively to incidents involving data theft.
When to use it
Use this skill when investigating unusual outbound data volumes or potential insider threats.
When not to use it
This skill may not be suitable for environments without adequate logging or telemetry data.
What you can build with it
Investigating Unusual Outbound Traffic
Use this skill to analyze network data when you notice spikes in outbound traffic that could indicate data theft.
Incident Response to Data Breaches
Deploy this skill during incident response to determine what data may have been exfiltrated and how.
Proactive Threat Hunting
Utilize this skill to hunt for indicators of compromise before a breach occurs, especially in high-risk sectors.
How to install Data Exfiltration Hunting
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/hunting-for-data-exfiltration-indicators --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Hunting for Data Exfiltration Indicators
When to Use
- When hunting for data theft in compromised environments
- After detecting unusual outbound data volumes or patterns
- When investigating potential insider threat data theft
- During incident response to determine what data was stolen
- When threat intel indicates data exfiltration campaigns targeting your sector
Prerequisites
- Network proxy/firewall logs with byte-level data transfer metrics
- DLP solution or CASB with cloud upload visibility
- DNS query logs for DNS exfiltration detection
- Email gateway logs for attachment monitoring
- SIEM with data volume anomaly detection capabilities
Workflow
- Define Exfiltration Channels: Identify potential channels (HTTP/S uploads, DNS tunneling, email attachments, cloud storage, removable media, encrypted protocols).
- Baseline Normal Data Flows: Establish baseline outbound data transfer volumes per user, host, and destination over a 30-day window.
- Detect Volume Anomalies: Identify hosts or users transferring significantly more data than baseline to external destinations.
- Analyze Transfer Destinations: Check destination domains/IPs against threat intel, identify newly registered domains, personal cloud storage, and foreign infrastructure.
- Inspect Protocol Abuse: Look for DNS tunneling (large/frequent TXT queries), ICMP tunneling, or data hidden in allowed protocols.
- Correlate with File Access: Link exfiltration indicators to file access events on sensitive file shares, databases, or repositories.
- Report and Contain: Document findings with evidence, estimate data exposure, and recommend containment actions.
Key Concepts
| Concept | Description |
|---|---|
| T1041 | Exfiltration Over C2 Channel |
| T1048 | Exfiltration Over Alternative Protocol |
| T1048.001 | Exfiltration Over Symmetric Encrypted Non-C2 |
| T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 |
| T1048.003 | Exfiltration Over Unencrypted/Obfuscated Non-C2 |
| T1567 | Exfiltration Over Web Service |
| T1567.002 | Exfiltration to Cloud Storage |
| T1052 | Exfiltration Over Physical Medium |
| T1029 | Scheduled Transfer |
| T1030 | Data Transfer Size Limits (staging) |
| T1537 | Transfer Data to Cloud Account |
| T1020 | Automated Exfiltration |
Tools & Systems
| Tool | Purpose |
|---|---|
| Splunk | SIEM for data volume analysis and SPL queries |
| Zeek | Network metadata for data flow analysis |
| Microsoft Defender for Cloud Apps | CASB for cloud exfiltration |
| Netskope | Cloud DLP and exfiltration detection |
| Suricata | Network IDS for protocol anomaly detection |
| RITA | DNS exfiltration and beacon detection |
| ExtraHop | Network traffic analysis for data flow |
Common Scenarios
- Cloud Storage Exfiltration: User uploads sensitive documents to personal Google Drive or Dropbox via browser.
- DNS Tunneling: Malware exfiltrates data encoded in DNS subdomain queries to attacker-controlled nameserver.
- HTTPS Upload: Compromised system POSTs large data blobs to C2 server over encrypted HTTPS.
- Email Attachment Exfiltration: Insider forwards sensitive documents to personal email accounts.
- Staging and Compression: Adversary stages data in compressed archives before slow exfiltration to avoid detection.
Output Format
Hunt ID: TH-EXFIL-[DATE]-[SEQ]
Exfiltration Channel: [HTTP/DNS/Email/Cloud/USB]
Source: [Host/User]
Destination: [Domain/IP/Service]
Data Volume: [Bytes/MB/GB]
Time Period: [Start - End]
Protocol: [HTTPS/DNS/SMTP/SMB]
Files Involved: [Count/Types]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Frequently asked questions about Data Exfiltration Hunting
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.