Most intrusions end the same way: data leaves. Catching exfiltration - ideally before it finishes - is one of the highest-value detections a blue team can build.
The channels
- Web / cloud uploads - HTTPS POSTs to file-sharing sites or attacker infrastructure.
- DNS tunneling - data smuggled in query labels when other egress is blocked.
- Cleartext protocols - FTP, HTTP, SMTP to unusual destinations.
- Cloud-native - sharing snapshots/buckets externally, or large object downloads.
- Physical / removable media - USB mass storage.
The signals
- Volume anomalies - a host or user sending far more outbound data than their baseline.
- New or rare destinations - large transfers to a never-seen domain/IP/ASN.
- Staging - lots of files suddenly archived (
.zip/.rar) before an upload. - Off-hours transfers - big uploads at 3am from a workstation.
- Sensitive-source access - mass reads from a database or file server preceding the upload.
Build the detection
Baseline normal egress per host/user, then alert on the deviation - and correlate the sequence (mass file access -> archive -> outbound spike). DLP helps, but behavior analytics on your own logs catches the cases DLP misses.