Runbook: Suspected Data Exfiltration¶

Runbook Metadata¶

Overview¶

What triggers this runbook: DLP policy violation for data upload to unapproved destination; anomalous volume of data transferred from internal host to external service; CASB detection of sensitive data upload to cloud storage; large attachment sent to external email; DNS tunneling signatures; anomalous SMB/FTP traffic.

Why this matters: Data exfiltration is the most impactful phase of many attacks and insider threat incidents. It triggers regulatory breach notification requirements. Early detection limits the scope of what was taken and enables legal action.

Common causes:

Triage Steps (Tier 1)¶

Step 1: Alert Classification¶

• [ ] 1.1 Identify the alert type:
• ☐ DLP — specific data classification triggered (PII, PCI, IP, etc.)
• ☐ Volume-based — large data transfer to external destination
• ☐ CASB — upload to unapproved cloud service
• ☐ Email — large attachment to external recipient

• ☐ DNS tunneling — high-entropy DNS queries, large DNS responses

• [ ] 1.2 Identify the affected user and host:

• User: ______
• Host: ______
• User role/department: ______
• User employment status: ☐ Active ☐ Pending departure ☐ On PIP

Step 2: Quick Context¶

• [ ] 2.1 What was transferred?
• Destination: ______
• Volume (MB/GB): ______
• File types (if known): ______

• Data classification: ☐ Public ☐ Internal ☐ Confidential ☐ Restricted/Regulated

• [ ] 2.2 Is the destination an approved service? (check approved cloud services list)

• ☐ Approved (e.g., corporate Box, SharePoint) → Possible FP

• ☐ Not on approved list → Escalate

• [ ] 2.3 Is this volume anomalous for this user? (check UEBA baseline)

• Typical daily upload volume: ______
• Today's volume: ______

Step 3: Quick Verification¶

• [ ] 3.1 Check if there's a change request or business justification for this transfer
• [ ] 3.2 Check if user is in a role that routinely handles large file transfers (backup admin, etc.)
• [ ] 3.3 Are there other alerts for this user/host in the past 7 days?

Investigation Steps (Tier 2)¶

Step 4: Data Scope Investigation¶

// DLP events for this user in last 30 days
DLPEvent
| where User == "{USER}"
| where Timestamp > ago(30d)
| project Timestamp, PolicyName, DataClassification, Destination, FileSize, Action
| order by Timestamp desc

// Proxy/web gateway logs for upload activity
WebProxyLogs
| where UserName == "{USER}"
| where Timestamp > ago(48h)
| where BytesSent > 10485760  // > 10MB
| project Timestamp, DestinationURL, BytesSent, Category
| order by BytesSent desc

// Email large attachments to external domains
EmailEvents
| where SenderEmailAddress contains "{USER}"
| where Timestamp > ago(30d)
| where RecipientEmailAddress !contains "{INTERNAL_DOMAIN}"
| where AttachmentCount > 0
| project Timestamp, RecipientEmailAddress, Subject, AttachmentNames

• [ ] 4.1 What is the total volume transferred in the past 30 days to external services?
• [ ] 4.2 Is this a single event or a pattern of transfers?
• [ ] 4.3 What specific files or data classifications were involved?
• [ ] 4.4 Did the user access data repositories unusually (SharePoint, code repo, file server) before the transfer?

Step 5: Destination Investigation¶

• [ ] 5.1 Identify the destination service:
• Is it a personal cloud account (personal Gmail Drive, personal Dropbox)?
• Is it a competitor's domain?
• Is it an anonymous file-sharing service?
• Is it a known C2 domain? (check TIP)
• [ ] 5.2 Obtain the destination account/URL if possible (for legal hold / law enforcement referral)
• [ ] 5.3 Check if the destination is accessible publicly (can legal recover data?)

Step 6: User Activity Timeline¶

Build a 30-day timeline of: - File access patterns (what repositories did they access, when?) - Large file operations (downloads from SharePoint, code repositories) - Email activity to external addresses - USB/removable media usage (if logged) - Print activity (if logged) - Application usage anomalies

Containment Actions¶

External Attacker Exfiltration¶

1. Contain the source host (isolate via EDR if malware involved)
2. Block identified exfiltration destination at proxy/firewall
3. Revoke attacker access (disable compromised accounts, revoke sessions)
4. Preserve logs immediately (external IPs, data accessed, timeline)

Insider Threat Suspected¶

1. Do NOT tip off the user — do not take visible containment action until legal advises
2. Notify HR and Legal immediately — insider threat cases require HR/Legal involvement
3. Preserve evidence silently: capture logs, emails, access records for legal use
4. Legal hold: HR/Legal to determine timing of account action and evidence preservation
5. Restrict access quietly (if instructed by Legal): modify permissions without visible notification

Regulatory Considerations¶

Engage legal immediately if any of the above apply. Regulatory notification requirements begin from when the breach is "discovered," not when it is fully investigated.

Evidence Preservation Checklist¶

Preserve in this order before any containment that may destroy evidence:

• [ ] Web proxy logs showing upload activity (full 90 days if possible)
• [ ] DLP alert data with file metadata
• [ ] Email records
• [ ] EDR telemetry for the user's host
• [ ] Authentication logs
• [ ] File access audit logs (SharePoint, file server)
• [ ] CASB/cloud access records
• [ ] USB/print logs if available

Document: What was preserved, when, from where, by whom (chain of custody)

References¶

• T1567 — Exfiltration Over Web Service
• T1020 — Automated Exfiltration
• CISA Insider Threat Mitigation Guide
• Related: RB-001 — Identity Anomaly | RB-002 — Endpoint Malicious Behavior

RB-004 v1.0 | Reviewed: 2025-Q4 | Next review: 2026-Q4