How should suspected exfiltration be reported?¶

The practical answer¶

Suspected exfiltration should be reported by separating what was accessed, prepared, transferred and received.

The key evidential caution¶

The dangerous assumption is that one suspicious outbound connection justifies stating that data was stolen.

It may not.

A defensible report should identify:

Key points¶

• the source data
• the account and process involved
• the staging activity
• the transfer mechanism
• the destination
• the time
• whether completion is confirmed
• what content can be identified
• what remains uncertain

Use precise language.

“Files were copied into an archive” is different from “the archive was uploaded.”

“An upload began” is different from “the destination received the complete file.”

“Outbound traffic increased” is different from “customer records were exfiltrated.”

Explain logging gaps, encryption, missing destination records and legitimate alternative explanations.

Where the data scope cannot be established exactly, report the supported minimum, maximum or category.

Evidential limits¶

Do not attribute the transfer to a person solely from the account, device or destination identifier.

Practical interpretation¶

Where several stages are strongly supported but the final receipt is not, describe the evidence as attempted or suspected exfiltration. Where destination records confirm receipt but the content cannot be identified, report the transfer separately from the data-scope conclusion. That precision prevents one uncertainty contaminating the whole assessment.

The report should identify which conclusion rests on direct records, which on correlation and which on inference. That makes the strength of the exfiltration assessment clear to later reviewers.

Operational takeaway¶

Report exfiltration in stages, distinguish confirmed transfer from preparation or suspicion and state clearly what data and destination can actually be proved.