Observe

Data exfiltration attempts are detected via alerts from Data Loss Prevention (DLP) control. Moreover, the behavior of outbound emails and network traffic such as C2 connections, protocol abuse, abnormal data transfer, and cloud storage attempts are monitored for possible detections.

Data size limits should also be monitored in a certain time interval. Analysts should also observe the usage of unauthorized applications like “WeTransfer” as well as Internal Staging (WMI calls, windows bits).

Enrich

DLP, EDR, and Active directory alerts would help to enrich the artifacts of the incident. Information at risk, process details, and user data can be fetched from these controls, respectively. 

Secondly, IoC enrichment should be performed for reputation checking, using multiple OSINT and threat intelligence sources. SIEM logs can also be cross-validated for additional correlation if the IoCs are detected previously.  

Decide

Considering the criticality of the stolen data and the privilege sensitivity of the compromised/involved user, decide the severity and the counteractions of the incident as per the hierarchy of the organization. If the insider is found suspicious, the input of the in-line manager may also be required before taking certain containment actions.

Act

There are multiple acts of remediation to choose from, depending on the vector of data exfiltration. One of the possible actions is blocking unauthorized communication channels and IoCs on perimeters. Depending on the mode of exfiltration, a group policy may be applied to revoke user access, USB and Bluetooth. In addition, whitelisting and blacklisting of applications on Edge firewall/endpoints can also be considered. Moreover, it is advisable to enable data encryption both in rest and in transit. It is also important to make sure to back up processes.  Furthermore, educating employees regarding the best practices of data security is always a recommendation to ensure data protection.

SOAR platforms can help automate many of the tasks involved in remediating a data exfiltration incident.  SOAR platforms help organizations in dealing with data exfiltration efficiently in an effective time interval. SIRP playbooks are capable of automating the incident response steps and counter the incident timely reducing the possible impact and risk.