Analytics Story: Data Exfiltration

Updated Date: 2026-05-13 ID: 66b0fe0c-1351-11eb-adc1-0242ac120002 Author: Bhavin Patel, Shannon Davis, Splunk Product: Splunk Enterprise Security

Description

Data exfiltration refers to the unauthorized transfer or extraction of sensitive or valuable data from a compromised system or network during a cyber attack. It is a critical phase in many targeted attacks, where adversaries aim to steal confidential information, such as intellectual property, financial records, personal data, or trade secrets.

Why it matters

This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) leveraged by adversaries to exfiltrate data from your environments. Exfiltration comes in many flavors and its done differently on every environment. Adversaries can collect data over encrypted or non-encrypted channels. They can utilise Command And Control channels that are already in place to exfiltrate data. They can use both standard data transfer protocols such as FTP, SCP, etc to exfiltrate data. Or they can use non-standard protocols such as DNS, ICMP, etc with specially crafted fields to try and circumvent security technologies in place. Techniques for getting data out of a target network typically include transferring it over their command and control channel or an alternate channel and may also include putting size limits on the transmission. In context of the cloud, this refers to the unauthorized transfer or extraction of sensitive data from cloud-based systems or services. It involves the compromise of cloud infrastructure or accounts to gain access to valuable information stored in the cloud environment. Attackers may employ various techniques, such as exploiting vulnerabilities, stealing login credentials, or using malicious code to exfiltrate data from cloud repositories or services without detection.

Correlation Search

AWS S3 Exfiltration Behavior Identified

 1| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count values(All_Risk.risk_message) as risk_message FROM datamodel=Risk.All_Risk
 2  WHERE All_Risk.annotations.mitre_attack.mitre_tactic = "collection"
 3    OR
 4    All_Risk.annotations.mitre_attack.mitre_tactic = "exfiltration" source = *AWS*
 5  BY All_Risk.risk_object
 6| `drop_dm_object_name(All_Risk)`
 7| `security_content_ctime(firstTime)`
 8| `security_content_ctime(lastTime)`
 9| where source_count >= 2 and mitre_tactic_id_count>=2
10| `aws_s3_exfiltration_behavior_identified_filter`

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
O365 PST export alert	Email Collection	TTP
AWS Exfiltration via EC2 Snapshot	Transfer Data to Cloud Account	TTP
O365 Exfiltration via File Sync Download	Data from Cloud Storage, Exfiltration Over Web Service	Anomaly
Gdrive suspicious file sharing	Phishing	Hunting
Linux Curl Upload File	Ingress Tool Transfer	TTP
AWS EC2 Snapshot Shared Externally	Transfer Data to Cloud Account	TTP
O365 Exfiltration via File Download	Data from Cloud Storage, Exfiltration Over Web Service	Anomaly
O365 Email Transport Rule Changed	Email Forwarding Rule, Email Hiding Rules	Anomaly
Plain HTTP POST Exfiltrated Data	Exfiltration Over Unencrypted Non-C2 Protocol	TTP
Detect SNICat SNI Exfiltration	Exfiltration Over C2 Channel	TTP
O365 Exfiltration via File Access	Data from Cloud Storage, Exfiltration Over Web Service	Anomaly
ASL AWS EC2 Snapshot Shared Externally	Transfer Data to Cloud Account	TTP
Excessive Usage of NSLOOKUP App	Exfiltration Over Alternative Protocol	Anomaly
Multiple Archive Files Http Post Traffic	Exfiltration Over Unencrypted Non-C2 Protocol	TTP
AWS Exfiltration via DataSync Task	Automated Collection	TTP
Windows TOR Client Execution	Multi-hop Proxy	Anomaly
High Volume of Bytes Out to Url	Exfiltration Over Web Service	Anomaly
O365 Application Available To Other Tenants	Additional Cloud Roles	TTP
ASL AWS Disable Bucket Versioning	Inhibit System Recovery	Anomaly
Mailsniper Invoke functions	Local Email Collection	TTP
AWS Disable Bucket Versioning	Inhibit System Recovery	Anomaly
O365 Email Access By Security Administrator	Remote Email Collection, Exfiltration Over Web Service	TTP
Detect Certipy File Modifications	Archive Collected Data, Steal or Forge Authentication Certificates	TTP
O365 DLP Rule Triggered	Exfiltration Over Alternative Protocol, Exfiltration Over Web Service	Anomaly
Windows Azure Storage Utility Execution Via CLI	Exfiltration to Cloud Storage	Anomaly
AWS Exfiltration via Batch Service	Automated Collection	TTP
Windows OneDrive Share Mounted via Net	Exfiltration to Cloud Storage	Anomaly
DNS Exfiltration Using Nslookup App	Exfiltration Over Alternative Protocol	TTP
AWS Exfiltration via Anomalous GetObject API Activity	Automated Collection	Anomaly
AWS Exfiltration via Bucket Replication	Transfer Data to Cloud Account	TTP
AWS AMI Attribute Modification for Exfiltration	Transfer Data to Cloud Account	TTP

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
O365	Other	`o365:management:activity`	`o365`
AWS CloudTrail DeleteSnapshot	AWS	`aws:cloudtrail`	`aws_cloudtrail`
AWS CloudTrail ModifySnapshotAttribute	AWS	`aws:cloudtrail`	`aws_cloudtrail`
AWS CloudTrail CreateSnapshot	AWS	`aws:cloudtrail`	`aws_cloudtrail`
AWS CloudTrail DescribeSnapshotAttribute	AWS	`aws:cloudtrail`	`aws_cloudtrail`
Office 365 Universal Audit Log	Other	`o365:management:activity`	`o365`
Sysmon for Linux EventID 1	Linux	`sysmon:linux`	`Syslog:Linux-Sysmon/Operational`
Cisco Isovalent Process Exec	Other	`cisco:isovalent:processExec`	`not_applicable`
Splunk Stream HTTP	Splunk	`stream:http`	`stream:http`
ASL AWS CloudTrail	AWS	`aws:asl`	`aws_asl`
Windows Event Log Security 4688	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
CrowdStrike ProcessRollup2	Other	`crowdstrike:events:sensor`	`crowdstrike`
AWS CloudTrail CreateTask	AWS	`aws:cloudtrail`	`aws_cloudtrail`
Nginx Access	Other	`nginx:plus:kv`	`/var/log/nginx/access.log`
Powershell Script Block Logging 4104	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-PowerShell/Operational`
AWS CloudTrail PutBucketVersioning	AWS	`aws:cloudtrail`	`aws_cloudtrail`
Sysmon EventID 11	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
AWS CloudTrail JobCreated	AWS	`aws:cloudtrail`	`aws_cloudtrail`
AWS CloudTrail GetObject	AWS	`aws:cloudtrail`	`aws_cloudtrail`
AWS CloudTrail PutBucketReplication	AWS	`aws:cloudtrail`	`aws_cloudtrail`
AWS CloudTrail ModifyImageAttribute	AWS	`aws:cloudtrail`	`aws_cloudtrail`

References

Source: GitHub | Version: 3