Detecting Data Exfiltration: Cloud Uploads, Archives and DNS Tunnels

Double-extortion ransomware and espionage both end in data theft. This pack covers detecting the exfiltration stage: staging archives, cloud-upload tooling (rclone, MEGA, WinSCP), large outbound transfers, and DNS tunneling. The common thread is anomalous egress — baseline normal outbound volume and destinations, then alert on deviation.

Signals at a Glance

Tooling & Staging

Alert on the execution of known exfil utilities and on bulk archive creation that precedes them — a sudden burst of 7-Zip or WinRAR spanning many directories is a staging signature:

title: Mass Archive Staging Before Exfiltration
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\7z.exe'
            - '\rar.exe'
            - '\WinRAR.exe'
        CommandLine|contains:
            - ' a '          # add to archive
            - '-hp'          # password-protected archive
    condition: selection
level: medium   # tune: alert on volume/frequency, not single use

Egress Anomalies

• Baseline outbound bytes per host/user and alert on large transfers to cloud-storage, file-sharing or newly-seen external destinations; flag rclone/MEGAcmd/WinSCP running on servers.
• Detect DNS tunneling: one host making a high volume of TXT/NULL queries, or many long, high-entropy subdomains of a single zone.
• Correlate staging (archive creation) followed by a large outbound transfer within a short window — a high-fidelity exfil sequence.