Topic starter
23/10/2026 12:45 am
TL;DR: Data exfiltration often slips past detection when attackers blend theft into normal-looking DNS, SMB, HTTP/S and ICMP traffic, according to Corelight. Network teams need evidence-rich outbound visibility to separate legitimate transfers from loss before response decisions harden.
Editorial analysis by NHI Mgmt Group, based on content published by Corelight: “Recognizing and detecting data exfiltration”.
Key questions
Q: Why do trusted protocols make data exfiltration harder to detect?
A: Trusted protocols are noisy because they carry legitimate business traffic all day.
Q: How do security teams know if exfiltration controls are actually working?
A: Look for evidence that bulk file access, compression, and outbound staging are detected early and correlated with privileged sessions.
Q: What breaks when exfiltration is only monitored at the perimeter?
A: Perimeter-only monitoring misses the protocol details and internal context that reveal abnormal outbound movement.
Practitioner guidance
- Map outbound visibility by protocol Inventory where DNS, SMB, HTTP/S and ICMP traffic are monitored end to end, then identify which paths lack behavioural review or flow-level logging.
- Baseline normal outbound transfer patterns Establish peer-group and host-level transfer baselines so unusually large uploads or odd destination changes stand out against local behaviour.
- Correlate network evidence before response decisions Preserve connection identifiers, file identifiers and pre- and post-transfer context so investigators can prove what left, how it left and whether it was authorized.
Bottom line: Exfiltration is often missed because attackers hide theft inside normal-looking network behaviour rather than exotic malware.
Glossary terms: Data Exfiltration, Behavior Baseline, Peer-Group Modeling, Egress Visibility
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
23/10/2026 9:49 am
Exfiltration is a governance problem before it is a detection problem: once data reaches the egress boundary, the security decision has already shifted from prevention to evidence handling. That makes network visibility a control plane for containment, disclosure and executive decision-making, not just an operations concern. Practitioners should treat outbound visibility as part of breach governance, not a niche SOC requirement.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: When should organisations prioritise egress visibility over more intrusion alerts?
A: They should prioritise egress visibility when the main concern is theft, extortion or regulated data loss rather than early intrusion discovery. Once an attacker is inside, the decisive question becomes whether outbound movement can be seen and proved, because that determines containment, disclosure and negotiation decisions.
👉 Read our full editorial: Network visibility gaps let data exfiltration evade detection
This post was modified 6 days ago by NHI Mgmt Group