What is data exfiltration, and how is it detected?
Exfiltration is the theft of data by copying it out of your network, often to cloud storage or to a server the attacker controls, and usually before ransomware encrypts anything. Attackers spread it over nights and weekends or keep each transfer small to avoid simple volume alarms. It is detected by comparing each host's outbound traffic with its own normal: destination, volume and time of day. Watch especially for uploads to cloud storage services or to addresses no other host uses, which public advisories on ransomware groups describe again and again. Encryption hides the content of a transfer, not its volume, destination or timing. NetSenX flags unusual outbound data volume per host, on every plan, Free included.