Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Hunting for Data Exfiltration Indicators · mukul975 | DecimalAI

Hunting For Data Exfiltration Indicators

SkillScore22Maintained

hunting-for-data-exfiltration-indicators

Hunt for data exfiltration through network traffic analysis, detecting unusual data flows, DNS tunneling, cloud storage uploads, and encrypted channel abuse.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/hunting-for-data-exfiltration-indicators/SKILL.md

decimalai skills pull hunting-for-data-exfiltration-indicators --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/hunting-for-data-exfiltration-indicators/SKILL.md https://app.decimal.ai/s/hunting-for-data-exfiltration-indicators/SKILL.md

Raw file: /s/hunting-for-data-exfiltration-indicators/SKILL.md ↗ · machine-readable summary at /s/hunting-for-data-exfiltration-indicators.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

Yes — +13% lift · at higher cost+30% tokens0% turns22% of whole cases pass with skill (5/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-01	✗→✓	▲ Improved	—	—
case-02	✗→✓	▲ Improved	—	—
case-20	✗→✓	▲ Improved	—	—
case-09	✓→✓	＝ Same ✓	—	—
case-17	✓→✓	＝ Same ✓	—	—

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/hunting-for-data-exfiltration-indicators/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 6 files · scripts

Skill contents

scripts/

references/

assets/

SKILL.md

Hunting for Data Exfiltration Indicators

When to Use

When hunting for data theft in compromised environments
After detecting unusual outbound data volumes or patterns
When investigating potential insider threat data theft
During incident response to determine what data was stolen
When threat intel indicates data exfiltration campaigns targeting your sector

Prerequisites

Network proxy/firewall logs with byte-level data transfer metrics
DLP solution or CASB with cloud upload visibility
DNS query logs for DNS exfiltration detection
Email gateway logs for attachment monitoring
SIEM with data volume anomaly detection capabilities

Workflow

Define Exfiltration Channels: Identify potential channels (HTTP/S uploads, DNS tunneling, email attachments, cloud storage, removable media, encrypted protocols).
Baseline Normal Data Flows: Establish baseline outbound data transfer volumes per user, host, and destination over a 30-day window.
Detect Volume Anomalies: Identify hosts or users transferring significantly more data than baseline to external destinations.
Analyze Transfer Destinations: Check destination domains/IPs against threat intel, identify newly registered domains, personal cloud storage, and foreign infrastructure.
Inspect Protocol Abuse: Look for DNS tunneling (large/frequent TXT queries), ICMP tunneling, or data hidden in allowed protocols.
Correlate with File Access: Link exfiltration indicators to file access events on sensitive file shares, databases, or repositories.
Report and Contain: Document findings with evidence, estimate data exposure, and recommend containment actions.

Key Concepts

| Concept | Description | |---------|-------------| | T1041 | Exfiltration Over C2 Channel | | T1048 | Exfiltration Over Alternative Protocol | | T1048.001 | Exfiltration Over Symmetric Encrypted Non-C2 | | T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 | | T1048.003 | Exfiltration Over Unencrypted/Obfuscated Non-C2 | | T1567 | Exfiltration Over Web Service | | T1567.002 | Exfiltration to Cloud Storage | | T1052 | Exfiltration Over Physical Medium | | T1029 | Scheduled Transfer | | T1030 | Data Transfer Size Limits (staging) | | T1537 | Transfer Data to Cloud Account | | T1020 | Automated Exfiltration |

Tools & Systems

| Tool | Purpose | |------|---------| | Splunk | SIEM for data volume analysis and SPL queries | | Zeek | Network metadata for data flow analysis | | Microsoft Defender for Cloud Apps | CASB for cloud exfiltration | | Netskope | Cloud DLP and exfiltration detection | | Suricata | Network IDS for protocol anomaly detection | | RITA | DNS exfiltration and beacon detection | | ExtraHop | Network traffic analysis for data flow |

Common Scenarios

Cloud Storage Exfiltration: User uploads sensitive documents to personal Google Drive or Dropbox via browser.
DNS Tunneling: Malware exfiltrates data encoded in DNS subdomain queries to attacker-controlled nameserver.
HTTPS Upload: Compromised system POSTs large data blobs to C2 server over encrypted HTTPS.
Email Attachment Exfiltration: Insider forwards sensitive documents to personal email accounts.
Staging and Compression: Adversary stages data in compressed archives before slow exfiltration to avoid detection.

Output Format

Hunt ID: TH-EXFIL-[DATE]-[SEQ]
Exfiltration Channel: [HTTP/DNS/Email/Cloud/USB]
Source: [Host/User]
Destination: [Domain/IP/Service]
Data Volume: [Bytes/MB/GB]
Time Period: [Start - End]
Protocol: [HTTPS/DNS/SMTP/SMB]
Files Involved: [Count/Types]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]

Illustrative Want to see what hunting-for-data-exfiltration-indicators would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 03:15 UTC · 23 cases

Lift

+13%

22% vs 9%

Agent turns

1.0 vs 1.0

Tokens

+30%

2,394.17 vs 1,835.39

fail → pass · 3pass → pass · 2fail → fail · 18

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-03 Threat intelligence indicates an active campaign using HTTPS POST requests to transfer sensitive files to rogue IP addresses. I need you to hunt through our network proxy logs for suspicious outbound payload spikes and output a detailed hunt report specifying a unique hunt identifier, exfiltration method, source system, external destination IP/domain, total data volume, active time range, protocol used, file count estimates, risk level, and overall confidence score.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 Why do threat actors commonly consolidate target files into password-protected RAR or ZIP archives in temp directories prior to outbound transmission?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 A script running on a compromised server automatically compresses and transmits database backups every night at 2 AM without manual attacker interaction. Which MITRE ATT&CK technique covers automated exfiltration?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 An insider threat copied confidential customer records onto an unencrypted external USB thumb drive and walked out of the building. What MITRE ATT&CK technique code tracks this method?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 We found a suspicious scheduled task named 'SystemUpdate' running `powershell -enc ...` on a domain controller. Please analyze how this persistence mechanism was established, review the registry keys modified, and provide remediation steps for removing the persistent scheduled task.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 Our network team noticed high frequency outbound DNS queries. What specific DNS query record type is most commonly abused for encoding and exfiltrating data payload chunks?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 An attacker used compromised AWS credentials to sync an internal S3 bucket directly to their own attacker-controlled AWS account. Which MITRE ATT&CK technique code covers transferring data directly to another cloud account?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 Our quarterly vulnerability scan identified CVE-2023-34362 (MOVEit Transfer SQL Injection) across three external-facing web servers. Please assess the severity of this vulnerability, explain the exploit mechanism, and outline patch verification steps.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 An attacker is splitting large database dumps into small 5MB chunks before exfiltrating them to evade threshold alerts. Which MITRE ATT&CK technique ID corresponds to staging and size limitation controls?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 We need an open-source network analysis tool specifically designed to inspect DNS query anomalies, detect DNS tunneling, and identify beaconing behaviors from our network capture logs. Should we deploy Snort, Wireshark, or another dedicated framework for this specific purpose?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 We observed 10 GB of encrypted data sent to an unknown external server. What critical workflow step must we perform immediately after identifying the outbound volume anomaly to determine what sensitive data was potentially compromised?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-11 We want to monitor cloud app uploads and enforce cloud DLP policies within Microsoft 365 environments. Which native Microsoft security product provides CASB capabilities for cloud exfiltration hunting?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-15 We need network metadata generation tools to record detailed connection logs and byte-level data flow metrics for traffic analysis without storing full packet captures. Which network analysis tool is primary for this network metadata logging?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 Our SOC wants to build a hunt hypothesis for data exfiltration via email attachments. Which specific log source must be ingested into the SIEM as a prerequisite for monitoring attachment uploads and email exfiltration?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-23 We collected a LSASS process dump from host SRV-APP-01 following suspected credential dumping. Can you analyze the memory dump structure and explain how Mimikatz extracts plaintext passwords or NTLM hashes from WDigest memory?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 We noticed an anomaly in our DNS logs where host WS-FIN-04 generated over 15,000 TXT queries to a newly registered nameserver over the weekend. Please execute a threat hunt for potential data exfiltration and provide a hunt summary that details the hunt tracking ID, channel identified, source host, external destination, estimated data volume, observation timeframe, protocol used, risk level, and confidence rating.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-02 Our CASB flagged a user account (m.chen@company.com) uploading several compressed ZIP files totaling 4.2 GB to a personal OneDrive account outside business hours. Can you investigate this outbound transfer anomaly for data theft indicators and format the findings with the exfiltration channel, source account, target destination, transfer volume, time window, protocol, number and type of files involved, risk severity, and confidence level?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-04 We are setting up an automated SIEM detection pipeline for data exfiltration volume anomalies. Our network team wants to calculate user outbound traffic baselines using a 7-day rolling window to save storage. What standard timeframe window should we configure for establishing normal outbound data baselines?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 During an audit of cloud storage activity, we found an attacker using exfiltration to personal cloud services like Box and Dropbox. Which specific MITRE ATT&CK sub-technique code should be assigned to this activity in our incident report?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 An adversary is transferring confidential IP using an SSH tunnel established directly to a rogue VPS, distinct from their primary C2 channel, using symmetric encryption. Which sub-technique ID under T1048 applies?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 An attacker configured a cron job to exfiltrate 50MB of data every hour on the hour to stay under volume threshold alarms. Which MITRE ATT&CK technique ID represents scheduled transfer?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-19 When analyzing external destination IPs and domains associated with large outbound uploads, what specific checks should be performed against destination infrastructure during the destination analysis workflow phase?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 We conducted a hunt on outbound SSH connections and found host DB-01 uploaded 18.5 GB to an external IP over port 22. Provide the standardized hunt summary block for this finding.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +13 percentage points is the difference between those two pass rates over the 23 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 8.7%
Pass rate with the skill: 21.7%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/28/2026, 03:15 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run22

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+46% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 55 days ago

Other measured skills in the registry, with their headline benchmark lift.