Data Exfiltration Investigation Guide
How to investigate suspected data exfiltration: volume anomalies, outbound funnel, and correlation of network, endpoint and account telemetry.
Quick Answer
Investigate data exfiltration by finding the outbound funnel — abnormally large/volumetric outbound transfers, unusual destination hosts or protocols, and the account/system that performed them — then scope, contain and preserve evidence.
Definition
An investigation procedure for a suspected data-exfiltration incident that correlates outbound-volume anomalies, transfer methods and account/system telemetry to scope the loss.
Goal
Determine whether data left the environment, what was taken, by whom, when, and through which channel — and preserve the evidence trail for response (MITRE Exfiltration tactic, TA0010).
Prerequisites
- Network egress logs (bytes, destinations, protocols) and cloud/blast-radius metadata.
- Endpoint and identity (auth) logs for the accounts of interest.
Evidence collection
- Capture outbound-flow statistics: top source→destination byte counts, unusual protocols (rare ports), and times.
- Snapshot the relevant files/datasets and their access history; hash samples for identification.
- Record account logon and data-access events for the suspected identities.
Indicators
- Persistent large outbound traffic to a single host, cloud-transfer/archive services (T1567), DNS tunneling, or staged archives staged then uploaded.
Validation
- Correlate the outbound-volume anomaly with an account/system event; a volume spike alone is weak evidence — pair it with access history or a matching IOC.
Investigation
- Identify the primary vector (network egress vs cloud) and pivot from destination → source account → source host. Use IP/DNS reputation on the destination (
guides:tool-ip-guide,guides:tool-dns-guide).
Decision
- Declare scope and containment owner if data sensitivity is high or breach confirmed.
Containment & mitigation
- Block/disable the offending account, isolate the host, stop the egress channel.
- Rotate secrets; revoke delegated/cloud tokens (
security:secrets-management).
Recovery & verification
- Notify affected stakeholders, restore/invalidate at-risk data, and re-verify stop of exfiltration.
References
- MITRE ATT&CK TA0010 / T1567; CISA guidance as listed.
References
Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.