Data Exfiltration Detection

Data exfiltration is the unauthorized transfer of sensitive data from a computer or other device. It's a primary objective for attackers who have breached a network. As a SOC analyst, our job is to detect and stop this before sensitive information walks out the door. This room will cover the common techniques attackers use to steal data and, more importantly, how we can catch them in the act.

Learning Objectives

In this room, we will cover the following learning objectives:

• Understand the common methods used for data exfiltration.
• Learn how to detect exfiltration attempts using network traffic analysis.
• Identify signs of exfiltration on endpoint devices.
• Correlate logs in a SIEM to uncover hidden exfiltration channels.

Prerequsites

This room expects the users to have covered or explored the following rooms:

• Wireshark: The Basics
• Network Security Essentials
• Splunk Basics
• Splunk: Exploring SPL

Let's begin our learning journey.