skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunting-for-data-exfiltration-indicators

Detect data exfiltration through network traffic analysis, DNS tunneling detection, and cloud upload monitoring.

954|172|Updated Mar 13, 2026
Search Tags:#network analysis#threat hunting#data exfiltration#siem#dlp#mitre attack#dns tunneling
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-data-exfiltration-indicators
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunting-for-data-exfiltration-indicators
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/hunting-for-data-exfiltration-indicators
Command: npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-data-exfiltration-indicators

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security teams struggle to spot data theft hidden in normal-looking outbound traffic, especially low-and-slow transfers, DNS tunneling, and encrypted uploads to personal cloud storage that evade simple volume thresholds.

Core Features & Use Cases

  • Volume Anomaly Detection: Baseline outbound data flows per user, host, and destination over 30 days and flag cumulative transfers that exceed normal patterns.
  • DNS Tunneling & Protocol Abuse Detection: Identify high-entropy subdomains, excessive TXT queries, ICMP tunneling, and data hidden in allowed protocols.
  • Cloud Exfiltration Visibility: Detect uploads to personal cloud storage (Drive, Dropbox, OneDrive) using CASB/DLP signals and out:in byte ratio analysis.
  • Use Case: During incident response, a hunter correlates a compromised host's file access events with a sudden spike in HTTPS uploads to a newly registered domain, confirming exfiltration and scoping the data exposure.

Quick Start

Hunt for data exfiltration indicators across our network logs for the past 30 days, focusing on DNS tunneling and unusual outbound data volumes.

Frequently Asked Questions about hunting-for-data-exfiltration-indicators

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect data exfiltration over DNS tunneling?▼

Detect DNS tunneling by analyzing DNS query logs for long, high-entropy subdomains and abnormally high TXT query rates to attacker-controlled nameservers. Tools like RITA and Zeek help score entropy and flag encoded data in queries.

How to find low and slow data exfiltration that evades volume alerts?▼

Sum bytes-out per destination over 7 to 30 day windows instead of alerting on single sessions, since techniques like T1030 size-limited transfers stay under daily thresholds. Alert on cumulative volume to unusual destinations.

What logs are needed for data exfiltration threat hunting?▼

You need network proxy and firewall logs with byte-level transfer metrics, DNS query logs, DLP or CASB cloud upload visibility, and email gateway logs. A SIEM with volume anomaly detection ties these sources together.

Can encrypted HTTPS exfiltration be detected without TLS inspection?▼

Yes, by pivoting on metadata: flag flows where bytes-out greatly exceed bytes-in to non-corporate ASNs, newly seen destinations, and personal cloud storage domains. CASB and DLP tools add body-level visibility where available.

How do I validate that exfiltration detection rules actually work?▼

Run Atomic Red Team tests for T1048 (DNS/ICMP exfil) and T1567.002 (cloud upload), then confirm your volume-anomaly and DNS-entropy searches fire on the test host and destination. Tune out backups and sanctioned cloud sync to reduce false positives.

Related Skills

Explore More Software Engineering Skills→
awsaws
2.5k

route53

Configures Amazon Route 53 DNS records, routing policies, health checks, DNS Firewall, and resolvers.

Official
Advanced
aviskaaraviskaar
6

incident-responder

Execute incident response for security events with triage, containment, and forensic investigation.

Official
Advanced
solitasrohsolitasroh
2

security-review

Perform STRIDE threat modeling for embedded MCU/MPU/WPF systems.

Community
Advanced
L3DigitalNetL3DigitalNet
6

tcpdump

Capture, filter, and inspect network traffic in real-time or save to pcap files.

Official
Intermediate