catch data exfiltration hiding in your traffic

the theft is already in your logs, you just haven't looked yet

data exfiltration doesn't announce itself. nobody gets a popup that says "hey, someone just zipped up your customer database and shipped it to a server in a country you've never done business with." it just looks like traffic. a connection. a request. the kind of thing your firewall waves through a thousand times a day without blinking.

the good news is that exfil almost always leaves a shape in the noise if you know what shape you're looking for. you don't need fancy tooling to start, you need to know your own baseline and a handful of patterns that don't belong in it.

the big outbound blob

most normal traffic on a network is bursty and mixed, small requests, page loads, api calls, backups on a schedule you already know about. one host suddenly pushing a large, sustained transfer to a single external ip it's never talked to before is one of the loudest tells there is, and it's also one of the easiest to miss because everyone assumes "big transfer" means "someone's backing something up" and moves on.

what you want to flag is the combination: unusual volume, unusual destination, unusual time. a workstation that normally sends a few megabytes a day suddenly pushing gigabytes at 2am to an ip that resolves to a vps provider nobody on your team has heard of is not a coincidence, it's a pattern worth ten minutes of your time.

dns tunneling: the quiet one

dns is the protocol everyone trusts and almost nobody watches closely, which makes it a favorite way to smuggle data out a little bit at a time. instead of one big obvious transfer, tunneling breaks the data into chunks, encodes it, and stuffs it into subdomains sent as dns queries to a domain the attacker controls.

the giveaway isn't one query, it's the pattern of queries. look for:

- unusually long subdomain names, often random-looking strings
- a very high volume of queries to one uncommon domain
- queries happening at a steady, mechanical rate instead of normal human browsing bursts
- txt or null record requests where you'd normally see a or aaaa lookups

if you're pulling dns logs and you see a single domain generating thousands of queries a day with subdomains that look like base32 garbage, that's not a typo-happy user, that's a channel.

personal cloud and paste sites

the simplest exfil method is also the most boring: someone drags a file into a personal google drive, dropbox, or a paste site, and hits upload. no malware, no fancy protocol abuse, just a browser doing exactly what browsers do every day. this is why blocklists alone don't cut it, plenty of legitimate work happens on these same services.

what actually helps is context. is this the account's normal cloud provider, or a personal account logging in from a corporate machine that shouldn't have access to it? is the upload volume way above what that user normally pushes to cloud storage? is it happening right after the person gave notice or got flagged in an hr dispute? traffic data plus a little bit of "does this make sense for this person right now" goes a long way.

baseline first, alert second

none of this works if you don't know what normal looks like. a large transfer is only suspicious relative to what that host, that user, that time of day usually does. spend time up front pulling netflow or proxy logs and just look, week over week, at typical volumes per host, typical destinations, typical dns query rates. write it down somewhere boring like a spreadsheet if you have to.

once you have that baseline, alerting gets a lot cheaper and a lot more accurate. you're not trying to catch "any large transfer," you're catching "large transfer that's abnormal for this specific host," which cuts your false positives dramatically and makes the real signal much easier to see.

the takeaway

exfiltration hides in plain sight because it borrows normal protocols and normal behaviors, dns, https, cloud storage, the stuff your network runs on all day anyway. you don't catch it by looking for something exotic, you catch it by knowing your own traffic well enough to notice when it stops looking like itself. build the baseline, watch for the big lonely transfer, the chatty weird dns domain, and the cloud upload that doesn't fit the person doing it. the theft is sitting in your traffic right now if it's happening, go find it before someone else has to tell you it was there.