What is low-and-slow data exfiltration, and how is it detected?
Low-and-slow exfiltration is stealing data in small amounts over a long time, so that no single transfer looks unusual: a few hundred megabytes every lunchtime for a month, or a steady trickle at night, often to a cloud storage service that many people use legitimately. Simple bandwidth alarms miss it because they look for spikes. It is caught by comparing each host with its own history over days and weeks: a server that never uploaded at lunchtime now does so every day, or a workstation sends a little to the same new destination at the same hour. Cloud storage and proxy logs can show it per user. Watch the total sent per host and destination over a week, not only per hour. NetSenX judges outbound volume against each host's normal destinations, volumes and times of day, on every plan.