What it does. Hunt for data exfiltration by analyzing Zeek and Suricata network telemetry for unusual data flows, DNS tunneling via large/frequent TXT queries, uploads to personal cloud storage, and encrypted-channel abuse, correlated against threat intel on destination domains. Use when hunting for data theft in a compromised environment, investigating unusual outbound data volumes, or determining what data was stolen during incident response. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-data-exfiltration-indicators, or copy the skill folder into ~/.claude/skills/hunting-for-data-exfiltration-indicators/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-data-exfiltration-indicators/SKILL.md

SKILL.md (verbatim)

name: hunting-for-data-exfiltration-indicators
description: Hunt for data exfiltration by analyzing Zeek and Suricata network telemetry for unusual data flows, DNS tunneling via large/frequent TXT queries, uploads to personal cloud storage, and encrypted-channel abuse, correlated against threat intel on destination domains. Use when hunting for data theft in a compromised environment, investigating unusual outbound data volumes, or determining what data was stolen during incident response.
domain: cybersecurity
subdomain: threat-hunting
tags:
- threat-hunting
- mitre-attack
- data-exfiltration
- dlp
- network-analysis
- proactive-detection
version: '1.0'
author: mahipal
license: Apache-2.0
atlas_techniques:
- AML.T0024
- AML.T0056
nist_ai_rmf:
- MEASURE-2.7
- MAP-5.1
- MANAGE-2.4
d3fend_techniques:
- File Metadata Consistency Validation
- Certificate Analysis
- Application Protocol Command Analysis
- Content Format Conversion
- File Content Analysis
nist_csf:
- DE.CM-01
- DE.AE-02
- DE.AE-07
- ID.RA-05
mitre_attack:
- T1046
- T1057
- T1082
- T1083
- T1048

Hunting for Data Exfiltration Indicators

When to Use

• When hunting for data theft in compromised environments
• After detecting unusual outbound data volumes or patterns
• When investigating potential insider threat data theft
• During incident response to determine what data was stolen
• When threat intel indicates data exfiltration campaigns targeting your sector

Prerequisites

• Network proxy/firewall logs with byte-level data transfer metrics
• DLP solution or CASB with cloud upload visibility
• DNS query logs for DNS exfiltration detection
• Email gateway logs for attachment monitoring
• SIEM with data volume anomaly detection capabilities

Workflow

1. Define Exfiltration Channels: Identify potential channels (HTTP/S uploads, DNS tunneling, email attachments, cloud storage, removable media, encrypted protocols).
2. Baseline Normal Data Flows: Establish baseline outbound data transfer volumes per user, host, and destination over a 30-day window.
3. Detect Volume Anomalies: Identify hosts or users transferring significantly more data than baseline to external destinations.
4. Analyze Transfer Destinations: Check destination domains/IPs against threat intel, identify newly registered domains, personal cloud storage, and foreign infrastructure.
5. Inspect Protocol Abuse: Look for DNS tunneling (large/frequent TXT queries), ICMP tunneling, or data hidden in allowed protocols.
6. Correlate with File Access: Link exfiltration indicators to file access events on sensitive file shares, databases, or repositories.
7. Report and Contain: Document findings with evidence, estimate data exposure, and recommend containment actions.

Key Concepts

Tools & Systems

Common Scenarios

1. Cloud Storage Exfiltration: User uploads sensitive documents to personal Google Drive or Dropbox via browser.
2. DNS Tunneling: Malware exfiltrates data encoded in DNS subdomain queries to attacker-controlled nameserver.
3. HTTPS Upload: Compromised system POSTs large data blobs to C2 server over encrypted HTTPS.
4. Email Attachment Exfiltration: Insider forwards sensitive documents to personal email accounts.
5. Staging and Compression: Adversary stages data in compressed archives before slow exfiltration to avoid detection.

Output Format

Hunt ID: TH-EXFIL-[DATE]-[SEQ]
Exfiltration Channel: [HTTP/DNS/Email/Cloud/USB]
Source: [Host/User]
Destination: [Domain/IP/Service]
Data Volume: [Bytes/MB/GB]
Time Period: [Start - End]
Protocol: [HTTPS/DNS/SMTP/SMB]
Files Involved: [Count/Types]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Data Exfiltration Hunt Template

Hunt Metadata

Hypothesis

[e.g., "Compromised endpoints are exfiltrating sensitive data to cloud storage or via DNS tunneling."]

Findings

Data Exposure Assessment

Recommendations

1. Block: [Destinations to block]
2. DLP: [Rules to deploy]
3. Monitor: [New detection rules]

references/api-reference.md (verbatim)

API Reference: Data Exfiltration Detection

Exfiltration Methods (MITRE ATT&CK)

DNS Exfiltration Indicators

Zeek Log Fields

conn.log

dns.log

Python Libraries

Shannon Entropy Formula

H(X) = -sum(p(x) * log2(p(x)))

Normal domain: H < 3.0, Exfil encoded: H > 3.5

references/standards.md (verbatim)

Standards and References - Data Exfiltration Hunting

MITRE ATT&CK Exfiltration (TA0010)

Detection Thresholds

Data Sources

references/workflows.md (verbatim)

Detailed Hunting Workflow - Data Exfiltration

Phase 1: Volume Anomaly Detection

Step 1.1 - Outbound Data Volume per Host

index=proxy OR index=firewall
| where NOT match(dest, "(?i)(microsoft|windowsupdate|google|amazonaws)")
| stats sum(bytes_out) as total_bytes_out by src_ip
| eval MB_out=round(total_bytes_out/1048576, 2)
| sort -MB_out
| head 50

Step 1.2 - Statistical Volume Anomaly

index=proxy earliest=-30d
| bin _time span=1d
| stats sum(bytes_out) as daily_bytes by src_ip _time
| eventstats avg(daily_bytes) as avg_daily stdev(daily_bytes) as sd_daily by src_ip
| where daily_bytes > (avg_daily + 3*sd_daily) AND daily_bytes > 104857600
| eval anomaly_factor=round(daily_bytes/avg_daily, 1)
| table _time src_ip daily_bytes avg_daily anomaly_factor

Phase 2: Cloud Storage Exfiltration

Step 2.1 - Cloud Upload Detection

index=proxy
| where match(dest, "(?i)(drive\.google|dropbox|box\.com|onedrive|mega\.nz|wetransfer|sendspace)")
| where method IN ("POST", "PUT")
| stats sum(bytes_out) as uploaded_bytes count by src_ip dest user
| eval MB_uploaded=round(uploaded_bytes/1048576, 2)
| where MB_uploaded > 50
| sort -MB_uploaded

Phase 3: DNS Exfiltration

Step 3.1 - DNS Tunneling Indicators

index=dns
| eval query_len=len(query)
| where query_len > 50
| rex field=query "^(?<subdomain>.+)\.(?<base_domain>[^.]+\.[^.]+)$"
| stats count avg(query_len) as avg_len dc(subdomain) as unique_subs by src_ip base_domain
| where count > 100 AND (avg_len > 40 OR unique_subs > 50)
| sort -count

Phase 4: Email Exfiltration

Step 4.1 - Large Email Attachments to External

index=email
| where match(recipient, "(?i)(gmail|yahoo|hotmail|protonmail|outlook)")
| where attachment_size > 10485760
| stats count sum(attachment_size) as total_size by sender recipient
| eval MB_sent=round(total_size/1048576, 2)
| sort -MB_sent

Phase 5: File Access Correlation

Step 5.1 - Sensitive File Access Before Exfiltration

Correlate file access events on sensitive shares with subsequent outbound data transfers:

index=wineventlog EventCode=5145
| where match(Share_Name, "(?i)(finance|hr|legal|confidential|restricted)")
| stats count values(Relative_Target_Name) as files by Account_Name Source_Address
| join Account_Name [
    search index=proxy method IN ("POST","PUT") earliest=-1h
    | stats sum(bytes_out) as upload_bytes by user
    | rename user as Account_Name
]
| where upload_bytes > 1048576

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.