Data Exfiltration Detection: How to Hunt Staging, DNS Tunneling and Bulk Downloads

Data exfiltration detection is how a security team catches its data being copied out, whether the data leaves from a server or laptop, slips out through DNS, or is pulled straight from a cloud or SaaS account.

For about five days in August 2025, an attacker used a stolen credential from Cloudflare's Salesloft integration to look around its Salesforce account. Then, on August 17, one Bulk API job exported Cloudflare's support cases in just over three minutes, and the attacker deleted the job about four minutes later. The whole theft ran through Salesforce's API, under an integration Cloudflare had connected itself. The case text it took also contained 104 Cloudflare API tokens, according to Cloudflare's own account.

You will usually find evidence of exfiltration in one of three places: the host where data is gathered, the network path it leaves by, or the audit logs of the service it is pulled from. Hunting each one means knowing what normal looks like there, because backups, sync clients and busy users routinely produce the same events. Each hunt below starts from a technique and the systems it touches, which is the directed approach to proactive threat hunting.

What does data exfiltration detection cover that DLP does not?

A DLP tool alerts when data that matches its policies moves, and triaging those DLP alerts is its own discipline. Data exfiltration detection covers theft that no policy flagged: data the policies were never written for, data sent through channels the DLP tool does not inspect, and data pulled from SaaS accounts with valid credentials. Because it works from behavior, such as staging, transfer tools, DNS patterns and download volume, it can catch data whose content no policy describes. The line between the two is not sharp, though. Insider risk tools such as Microsoft Purview Insider Risk Management also correlate activity signals to flag data theft, including theft by departing employees.

Exfiltration often comes right before ransomware encryption as well. CISA's advisory on Akira, for example, says its affiliates encrypt systems after exfiltrating data, and it names FileZilla, WinRAR, WinSCP and Rclone among the tools they use to take it (CISA).

{{ebook-cta}}

How to hunt for data staging before it leaves

For data exfiltration detection on a host, staging is often one of the earliest points to catch a theft. Attackers commonly gather data in one place and compress it before sending it out. MITRE ATT&CK tracks the gathering as Data Staged and the compression as Archive via Utility. Its examples for the second technique include 7-Zip or WinRAR use by Akira, Play, INC Ransom and Volt Typhoon.

• Archive tools on servers. 7-Zip, WinRAR or rar.exe running on file servers, domain controllers or database hosts where compressing files is unusual, especially for large or password-protected archives. Check the command line too. A password switch (-p) encrypts the contents so content inspection cannot read them, and for 7z archives, adding -mhe hides the file names as well (7-Zip documentation).
• Collection into one folder. One account copying many files from shares or user directories into a single directory, such as a temp or public folder, in a short window.
• Staging inside the cloud. Database exports to temporary locations. In the 2024 Snowflake data theft, the attackers created a temporary stage, wrote tables into it as GZIP-compressed files with COPY INTO, and pulled the files down with GET (Mandiant).

Backup jobs, build systems and administrators compressing logs produce the same events, so first establish which accounts and hosts normally run archive tools.

How to hunt exfiltration tools and cloud storage uploads

Uploads to cloud storage can blend in with traffic to services the business already uses, as MITRE ATT&CK notes in its entry on exfiltration to cloud storage. Its examples name Rclone, MEGAsync, MEGAcmd and AzCopy among the tools attackers use.

• Transfer tools where they do not belong. Rclone, MEGAsync, WinSCP or FileZilla running on servers or under service accounts. Match on file hashes and signatures as well as names, because a renamed copy keeps the same hash. Hashes only match releases you already know, though, so match on command syntax as well. A renamed Rclone still runs commands such as copy and sync (Rclone documentation).
• Command lines that name a cloud remote. Rclone commands that copy local paths to a configured remote, and newly written Rclone configuration files. Rclone looks first for rclone.conf in the same folder as the executable, then at %APPDATA%\rclone\rclone.conf on Windows, and a --config flag can point it anywhere (Rclone documentation).
• User agents. In proxy logs, Rclone sends a user agent of rclone/ plus its version number, unless the operator sets a different one with --user-agent (Rclone documentation).
• Outbound volume. Hosts sending far more data than usual to file-sharing or cloud storage domains, measured against each host's own history in proxy and firewall logs. MITRE's detection guidance for the technique also points to high outbound volume to cloud storage services (MITRE).
• The command and control channel. Data can also leave over a channel the attacker already uses to control the host, which MITRE ATT&CK tracks as Exfiltration Over C2 Channel. Its detection guidance looks for processes that read sensitive files and then open unusual outbound connections.

When a hit lands on a host, walk its process tree the way you would for EDR alerts: what started the tool, under which account, and what it read before it connected out. Keep in mind that sanctioned sync clients and backup agents routinely send large volumes to the company's own cloud storage. The stronger leads are uploads to accounts or tenants the company does not own, and transfers from hosts that rarely sent much before.

How to hunt DNS tunneling

DNS tunneling hides data inside DNS queries, usually as encoded subdomains of a domain the attacker controls. Each DNS label can hold at most 63 octets and a full name at most 255, under RFC 1035. So a tunnel has to split any sizable amount of data across many queries, and those queries form a pattern you can hunt for.

• Long names. Elastic's researchers treated subdomains longer than 180 characters, or names with two or more labels longer than 52 characters, as highly suspicious (Elastic).
• High entropy. Encoded data looks random, so tunnel subdomains tend to score high on entropy measures (MITRE).
• Single-use subdomains. A parent domain whose subdomains are almost all queried once, which Elastic measures as a high ratio of unique subdomains to queries (Elastic).
• Unusual record types. NULL and private record types have very limited legitimate uses, and a high count or size of TXT records for one domain can expose simpler tunnels (Elastic).
• Unexpected query sources. Frequent DNS queries from processes that rarely make them, such as PowerShell, rundll32 or python.exe. MITRE's detection strategy for DNS tunneling uses this signal on Windows hosts (MITRE).

On the network side, resolver logs or Zeek's dns.log, which records each query and its type (Zeek documentation), are the main sources. Resolver logs miss DNS that bypasses your resolvers, and Zeek cannot read DNS over HTTPS sent to an outside resolver, which travels as ordinary HTTPS. NSA recommends sending all DNS, encrypted or not, only to the enterprise resolver, so a host that queries any other resolver is a lead in its own right (NSA). On Windows hosts, Sysmon's DNS query events add the process behind each query that goes through the Windows DNS client (MITRE, XPN). Review hits by parent domain, and allowlist the parent domains your own tools and vendors use, such as CDNs, reputation lookups and blocklist services like Spamhaus, which also produce long or random-looking names (Elastic), before turning a DNS hunt into an alert. Because a slow tunnel can stay under rate thresholds, check length and entropy as well as volume.

How to hunt bulk downloads from cloud storage and SaaS

Some data theft never touches a server the victim runs. An attacker holding a valid login, OAuth token or API key can pull data straight from cloud storage or a SaaS application, so the main record is in that service's audit logs, if those logs are turned on.

• Amazon S3. CloudTrail trails do not log data events such as GetObject by default, and data events cost extra (AWS documentation). Without them, CloudTrail has no record of who downloaded which objects. S3 server access logs can fill the gap, but they are off by default, and GuardDuty S3 Protection analyzes S3 data events without a trail logging them. With data events on, look for principals reading far more objects than usual, first-time reads of sensitive buckets, and reads from addresses the principal has not used before.
• Sharing with outside accounts. Not every cloud theft needs a download. An attacker can share a snapshot with an account they control, or change a bucket policy to grant one access, which MITRE ATT&CK tracks as Transfer Data to Cloud Account. In AWS, these changes (ModifySnapshotAttribute, PutBucketPolicy) are management events, which CloudTrail keeps in event history for 90 days without a trail.
• SharePoint and OneDrive. Microsoft 365 records FileDownloaded when a user downloads a file and FileSyncDownloadedFull when the OneDrive sync app downloads one (Microsoft documentation). A spike in either for one account is a lead. But a new laptop syncing a large library produces the same events, so check the device and session before escalating. A download can also log under another name. Varonis showed that opening a file in a desktop app logs FileAccessed instead of FileDownloaded, and that a download with a spoofed sync client user agent logs as FileSyncDownloadedFull. Sharing moves data without any download, so watch for anonymous links (AnonymousLinkCreated) and invitations to outside users (SharingInvitationCreated) as well (Microsoft documentation).
• Salesforce and other SaaS. Watch for large exports. In the Cloudflare case, the export was a Bulk API 2.0 job, and Cloudflare recommends monitoring for large data exports and for logins from unfamiliar locations (Cloudflare). The attacker also deleted the export job to cover its tracks, so a large export followed by a deleted job is worth checking against what that integration normally does. Treat a login from a new location just before a large export the way you would an impossible travel alert. Check what your org records first. Beyond a free core set such as Login and API Total Usage, kept for one day, most Salesforce event types need Shield or the Event Monitoring add-on (Salesforce).
• Snowflake and other data warehouses. Query history shows reconnaissance such as SHOW TABLES ahead of staging and export, and Mandiant's hunting guidance for the 2024 campaign could reach back 365 days under default retention (Mandiant).

Many of the same hunts cover insiders, such as an employee pulling files before leaving. Insider theft can also run through USB drives and email forwarding rules that send mail to personal accounts, so an insider hunt needs endpoint and email logs as well. Prophet AI Threat Hunter's hunt library includes curated hunts named SharePoint and OneDrive Insider Exfiltration, Data Staging for Exfiltration and Exfiltration to Web Service Destinations, which run on their own at the cadence a team sets.

What to do when an exfiltration hunt finds something

Treat a hit as a lead until someone confirms what moved. If the theft may still be running, containment usually comes first: revoke the token or session, disable the account or integration, and block the destination. Cloudflare disabled the compromised Drift integration and disconnected its third-party integrations from Salesforce (Cloudflare). Check with the data owner or the user, establish what data left, how much left and where it went, and preserve the relevant logs before retention removes them. If an insider may be involved, bring in HR and legal before anyone contacts the user, so the user is not tipped off. Bring in legal or privacy early in any case, because confirmed theft of personal data can start notification deadlines, such as the GDPR's 72 hours for notifying regulators where feasible (GDPR Article 33). Then search the stolen data for secrets. Cloudflare searched the exported support cases, found 104 of its own API tokens and rotated them (Cloudflare).

Suspicious hits also need a full investigation. Prophet AI Threat Hunter hands its suspicious leads to Prophet AI SOC Analyst, which investigates each one and returns a determination with the queries and evidence behind it. It runs DLP investigations the same way when a policy fires. When a hunt finds real exfiltration, the logic behind it becomes a candidate detection, the loop described in our post on detection engineering.

Most of the evidence for data exfiltration detection is already in logs you collect, or could collect with a configuration change or an add-on license: process events, DNS logs, proxy logs and cloud audit trails. Prophet AI Threat Hunter runs these hunts across those sources, and you can see it work in your own environment.