SkillsAdd

mukul975/anthropic-cybersecurity-skills

hunting-for-data-exfiltration-indicators

Hunt for data exfiltration by analyzing Zeek and Suricata network telemetry for unusual data flows, DNS tunneling via large/frequent TXT queries, uploads to personal cloud storage, and encrypted-channel abuse, correlated against threat intel on destination domains.

First seen Mar 15, 2026

Installation

$ npx skills add mukul975/anthropic-cybersecurity-skills --skill hunting-for-data-exfiltration-indicators
View on skills.sh ↗ GitHub repository ↗

Summary

  • Hunt for data exfiltration by analyzing Zeek and Suricata network telemetry for unusual data flows, DNS tunneling via large/frequent TXT queries, uploads to personal cloud storage, and encrypted-channel abuse, correlated against threat intel on destination domains.
  • Use when hunting for data theft in a compromised environment, investigating unusual outbound data volumes, or determining what data was stolen during incident response.

Also in this package

Other skills from mukul975/anthropic-cybersecurity-skills · top by installs.

npx skills add mukul975/anthropic-cybersecurity-skills
analyzing-api-gateway-access-logs 726 acquiring-disk-image-with-dd-and-dcfldd 653 analyzing-android-malware-with-apktool 620 testing-api-security-with-owasp-top-10 591 analyzing-cyber-kill-chain 586 Create Fake Materials: Fake Website 575 analyzing-browser-forensics-with-hindsight 574 conducting-api-security-testing 565 analyzing-docker-container-forensics 553 analyzing-cloud-storage-access-patterns 540

Browse all from mukul975/anthropic-cybersecurity-skills

More details

Agent compatibility

Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.

Claude Code Not declared
Cursor Not declared
Codex Not declared
GitHub Copilot Not declared
Windsurf Not declared
Gemini CLI Not declared
Cline Not declared
OpenCode Not declared

Repository health

Stars 32.4K
License LICENSE
Default branch main
Open issues 20
Status Active

Skill metadata

Parsed from SKILL.md frontmatter.

Version1.0
LicenseApache-2.0

Package contents

Files included with this skill beyond the listing page.

  • skill md SKILL.md 4,786 B
  • docs SUMMARY.md 482 B

History

  1. First seen on skills.sh
  2. First recorded snapshot · 78 installs

SKILL.md

Hunting for Data Exfiltration Indicators

When to Use

  • When hunting for data theft in compromised environments
  • After detecting unusual outbound data volumes or patterns
  • When investigating potential insider threat data theft
  • During incident response to determine what data was stolen
  • When threat intel indicates data exfiltration campaigns targeting your sector

Prerequisites

  • Network proxy/firewall logs with byte-level data transfer metrics
  • DLP solution or CASB with cloud upload visibility
  • DNS query logs for DNS exfiltration detection
  • Email gateway logs for attachment monitoring
  • SIEM with data volume anomaly detection capabilities

Workflow

  1. Define Exfiltration Channels: Identify potential channels (HTTP/S uploads, DNS tunneling, email attachments, cloud storage, removable media, encrypted protocols).
  2. Baseline Normal Data Flows: Establish baseline outbound data transfer volumes per user, host, and destination over a 30-day window.
  3. Detect Volume Anomalies: Identify hosts or users transferring significantly more data than baseline to external destinations.
  4. Analyze Transfer Destinations: Check destination domains/IPs against threat intel, identify newly registered domains, personal cloud storage, and foreign infrastructure.
  5. Inspect Protocol Abuse: Look for DNS tunneling (large/frequent TXT queries), ICMP tunneling, or data hidden in allowed protocols.
  6. Correlate with File Access: Link exfiltration indicators to file access events on sensitive file shares, databases, or repositories.
  7. Report and Contain: Document findings with evidence, estimate data exposure, and recommend containment actions.

Key Concepts

Concept Description
T1041 Exfiltration Over C2 Channel
T1048 Exfiltration Over Alternative Protocol
T1048.001 Exfiltration Over Symmetric Encrypted Non-C2
T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2
T1048.003 Exfiltration Over Unencrypted/Obfuscated Non-C2
T1567 Exfiltration Over Web Service
T1567.002 Exfiltration to Cloud Storage
T1052 Exfiltration Over Physical Medium
T1029 Scheduled Transfer
T1030 Data Transfer Size Limits (staging)
T1537 Transfer Data to Cloud Account
T1020 Automated Exfiltration

Tools & Systems

Tool Purpose
Splunk SIEM for data volume analysis and SPL queries
Zeek Network metadata for data flow analysis
Microsoft Defender for Cloud Apps CASB for cloud exfiltration
Netskope Cloud DLP and exfiltration detection
Suricata Network IDS for protocol anomaly detection
RITA DNS exfiltration and beacon detection
ExtraHop Network traffic analysis for data flow

Common Scenarios

  1. Cloud Storage Exfiltration: User uploads sensitive documents to personal Google Drive or Dropbox via browser.
  2. DNS Tunneling: Malware exfiltrates data encoded in DNS subdomain queries to attacker-controlled nameserver.
  3. HTTPS Upload: Compromised system POSTs large data blobs to C2 server over encrypted HTTPS.
  4. Email Attachment Exfiltration: Insider forwards sensitive documents to personal email accounts.
  5. Staging and Compression: Adversary stages data in compressed archives before slow exfiltration to avoid detection.

Output Format

Hunt ID: TH-EXFIL-[DATE]-[SEQ]
Exfiltration Channel: [HTTP/DNS/Email/Cloud/USB]
Source: [Host/User]
Destination: [Domain/IP/Service]
Data Volume: [Bytes/MB/GB]
Time Period: [Start - End]
Protocol: [HTTPS/DNS/SMTP/SMB]
Files Involved: [Count/Types]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]