Data exfiltration detection: are your controls keeping up?

TL;DR: Data exfiltration is the final and most damaging act in many breaches because it hides inside trusted protocols and often escapes tools tuned to detect intrusion rather than outbound transfer, according to Corelight. Its analysis argues that layered network evidence and anomaly detection are what make board-ready decisions defensible.

Editorial analysis by NHI Mgmt Group, based on content published by Corelight: “Recognizing and detecting data exfiltration”.

Key questions

Q: What breaks when exfiltration is only monitored at the perimeter?

A: Perimeter-only monitoring misses the protocol details and internal context that reveal abnormal outbound movement.

Q: Why do trusted protocols make data exfiltration harder to detect?

A: Trusted protocols are noisy because they carry legitimate business traffic all day.

Q: How do security teams know if exfiltration controls are actually working?

A: Look for evidence that bulk file access, compression, and outbound staging are detected early and correlated with privileged sessions.

Practitioner guidance

• Map outbound visibility by protocol Inventory where DNS, SMB, HTTP/S and ICMP traffic are monitored end to end, then identify which paths lack behavioural review or flow-level logging.
• Baseline normal outbound transfer patterns Establish peer-group and host-level transfer baselines so unusually large uploads or odd destination changes stand out against local behaviour.
• Correlate network evidence before response decisions Preserve connection identifiers, file identifiers and pre- and post-transfer context so investigators can prove what left, how it left and whether it was authorized.

Bottom line: Exfiltration is often missed because attackers hide theft inside normal-looking network behaviour rather than exotic malware.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →