Key Takeaways
The 2020 Magellan Health breach exposed data on 365,000 patients and employees, and the data left over several weeks before detection, according to Fidelis Security.
Logs record only what each system is configured to capture, and flow data shows who communicated and how much, but neither shows what a transfer contained.
Full packet capture records every packet, so analysts can reconstruct sessions and confirm exactly what data left the network.
SentryWire retains captured traffic for weeks, months, or years and integrates Suricata, so new indicators of compromise can be checked against historical traffic.
Data exfiltration detection is a security practice that identifies unauthorized transfers of data out of an organization’s network, endpoints, or cloud services by analyzing outbound traffic, user behavior, and system activity. Effective detection both flags suspicious transfers and confirms which data left, where it went, and when the transfer started.
Most detection methods end at an alert, such as a spike in outbound traffic, a suspicious DNS pattern, or a connection to a flagged destination. Analysts must then decide whether a large transfer was a backup or theft, and logs alone rarely settle the question.
SentryWire builds enterprise-grade full packet capture for regulated, high-risk environments where proving what left the network matters. This page covers how the theft works, why it is hard to catch, which detection methods exist, and where packet evidence closes the gap.
What Is Data Exfiltration?
Data exfiltration is the unauthorized transfer of data out of an organization’s control, carried out by an external attacker, a malicious insider, or malware. It often appears late in an attack, so detection is frequently the last chance to limit the damage.
Attackers and malicious insiders go after customer records, intellectual property, and credentials. Accidental data leakage, such as an employee sending files to a personal account, produces the same network traffic and needs the same visibility. Insider cases are especially hard because the access itself is authorized.
Attackers move stolen data out through a few common channels:
Encrypted HTTPS uploads to attacker-controlled servers or legitimate cloud storage
DNS tunneling, where stolen data is encoded into DNS queries
Personal email and cloud storage accounts, such as Google Drive or Dropbox
Uncommon ports and protocols, including Internet Control Message Protocol (ICMP)
Command-and-control (C2) channels that double as exit paths
The MITRE ATT&CK framework tracks exfiltration as its own tactic, with techniques such as exfiltration over web services and exfiltration over alternative protocols.
Why Is Data Exfiltration So Hard to Detect?
It is hard to detect because the traffic is built to look like normal outbound activity, and normal varies by user, application, and time of day. A transfer that is routine for a finance analyst may be anomalous for a developer workstation.
The 2020 Magellan Health incident shows the cost. Attackers used phishing to steal credentials, and data on 365,000 patients and employees left the environment over several weeks before the breach was identified, according to Fidelis Security.
A few factors compound the problem:
Encryption hides payloads from inspection, so content-based rules see nothing.
Low-and-slow transfers stay under volume thresholds for weeks or months.
Legitimate bulk transfers, such as backups, generate false positives that wear down analyst attention.
What Are the Main Methods for Detecting Data Exfiltration?
Teams detect exfiltration with outbound traffic baselining, DNS analysis, threat intelligence matching, signature and behavioral detection, data loss prevention (DLP), and endpoint detection and response (EDR). Each flags suspicious activity, and none by itself proves what data left.
Security teams usually combine these approaches:
Outbound traffic baselining: flags changes in volume, timing, or destination against per-user and per-system norms.
DNS analysis: finds tunneling through long subdomains, high query volumes, and unusual record types.
Threat intelligence matching: compares destinations with known malicious infrastructure and indicators of compromise (IOCs).
Signature and behavioral detection: Suricata rules catch known tools, while anomaly detection and behavioral analytics flag unknown activity.
DLP: enforces policy on sensitive files and data patterns leaving endpoints, email, and cloud apps.
EDR: flags mass file reads, archive creation, and uploads on the host itself.
The shared limitation is that each method produces an alert or a pattern, and none shows the contents of the transfer.
Why Logs and Flow Data Aren’t Enough for Data Exfiltration Detection
Logs and flow data show that a transfer happened, but not what it contained. That gap leaves analysts unable to confirm a true positive, name the files taken, or scope the incident.
| Data source | What it records | What it cannot show |
|---|---|---|
| System and application logs | Events each system was configured to record | Payload content, and any activity the system did not log or an attacker altered |
| Flow data (such as NetFlow) | Source, destination, ports, and byte counts | The contents of the transfer, so a backup and a theft look alike |
| Full packet capture | Every packet, including payloads, sessions, and file artifacts | The contents of encrypted payloads, though metadata and session behavior remain visible |
Only full packet capture gives analysts the contents and context of a transfer, which is what confirms a detection.
Logs have a second weakness: attackers with administrative access can delete or alter local records. Flow data survives that problem, but it still cannot tell a stolen customer database from a scheduled backup of the same size. Without payload-level evidence, response teams slow down and legal or compliance positions weaken.
How Does Full Packet Capture Strengthen Exfiltration Detection?
Full packet capture strengthens detection by recording every packet that crosses the monitored network, so analysts can reconstruct sessions, extract file artifacts, and confirm what left. It turns a suspicious alert into a scoped, evidence-backed finding.
SentryWire’s full packet capture platform captures traffic at sustained 10Gbps+ speeds and retains it for weeks, months, or years on commodity hardware. That retention matters because low-and-slow theft can run for months before anyone notices.
Even when payloads are encrypted, preserved packet metadata, session behavior, and traffic patterns give investigators context that flow-only tools cannot deliver. Packet capture does not read encrypted payloads on its own, so analysts work from destinations, volumes, timing, and session behavior in those cases.
SentryWire’s integrated Suricata engine supports retrospective search-back. When a new IOC surfaces, analysts can run it against stored traffic and find earlier transfers that no rule caught at the time. This is the core of effective threat hunting across months of history.
Integration with SIEM and SOAR platforms lets analysts pivot from an alert to the matching packets during incident response. Full packet capture complements DLP, network detection and response (NDR), and EDR tools rather than replacing them, and it is built for enterprise scale, not for teams that need only flow monitoring.
How Does Exfiltration Detection Support Compliance?
Confirming whether data left the network shapes what an organization must investigate and report. Retained packet evidence supports audit-ready documentation under Office of Management and Budget memorandum M-21-31, the North American Electric Reliability Corporation Critical Infrastructure Protection (NERC-CIP) standards, System and Organization Controls 2 (SOC 2), the Health Insurance Portability and Accountability Act (HIPAA), and Securities and Exchange Commission (SEC) Rule 17a-4.
Compliance outcomes depend on documented evidence, not alerts alone. For teams in regulated environments, a stored record of what crossed the network is what lets an organization show what was and was not taken.
Best Practices for Detecting Data Exfiltration
Effective detection combines per-system baselines, DNS monitoring, long retention, layered methods, and the ability to pivot from an alert to packets. Detection supports efforts to prevent data exfiltration but does not replace preventive security measures such as access controls.
These practices apply in most enterprise environments:
Baseline normal egress traffic for each user and system rather than relying on a single threshold.
Monitor DNS closely for long subdomains and unusually high query volumes to one domain.
Retain network data long enough to cover realistic attacker dwell time.
Combine signature-based and behavior-based detection, and add proactive threat hunting.
Integrate with a security information and event management (SIEM) platform and a security orchestration, automation, and response (SOAR) platform so analysts can pivot from an alert to packets.
Monitor outbound traffic continuously, test detections with simulated theft, and tune on a schedule.
Confirming What Left the Network
Layered detection finds suspicious transfers, but only packet-level evidence confirms and scopes them. Logs and flow data point analysts toward the problem, and retained packets show exactly what was taken.
To see how retained packet data supports your investigations, review SentryWire’s network security monitoring capabilities, read the platform overview, or contact the SentryWire team to discuss your environment.
FAQ copy provided, do not rewrite.
Frequently Asked Questions About Data Exfiltration
What is the difference between data exfiltration and a data breach?
A data breach is any unauthorized access to or exposure of sensitive data, while data exfiltration is the actual transfer of that data out of an organization’s control. A breach can happen without exfiltration, for example when data is viewed but never copied. Confirming whether data left the network often determines the true scope of an incident and what an organization must disclose.
What are the signs of data exfiltration?
Common signs include unexplained spikes in outbound traffic, large transfers at unusual hours, and connections to unfamiliar external destinations. Other indicators are abnormal volumes of DNS queries, compressed archives leaving the network, and repeated uploads to personal cloud storage. No single sign is conclusive, so analysts verify suspicious activity against the underlying network traffic before acting.
Can you detect data exfiltration in encrypted traffic?
Data exfiltration can often be detected in encrypted traffic without decrypting it. Analysts examine metadata such as destination, transfer volume, timing, and session behavior to spot transfers that do not fit normal patterns. Full packet capture preserves that session-level record, so investigators can analyze encrypted exfiltration after the fact, even when they cannot read the payload.
How long should you retain network data to investigate exfiltration?
Retain network data for at least as long as your realistic attacker dwell time, which for many organizations means months rather than weeks. Low-and-slow exfiltration can continue for a long time before anyone notices, and short retention erases the evidence needed to scope it. Platforms that capture on commodity hardware, such as SentryWire, make long retention more affordable.
Is DLP enough to detect data exfiltration?
Data loss prevention (DLP) alone is not enough to detect data exfiltration. DLP tools match data against policies and known patterns, so they can miss exfiltration over encrypted channels, covert protocols such as DNS, or data that has been encoded or split into pieces. DLP works best paired with network monitoring that records what actually crossed the wire, giving analysts both policy alerts and the packet evidence to verify them.
