No-Cost Data Exfiltration Artifact Detection

Data exfiltration is an all too often occurrence in businesses all over the world, resulting in not only a monetary loss to the business but other negative effects like reputational damage, market loss, and possibly permanent loss of business. The traditional focus is to keep the bad guys from penetrating the company network and stealing valuable data. But what about insider threats?While enterprise-class tools are available to detect and prevent data exfiltration, smaller businesses may be susceptible to data theft because they cannot afford costly solutions in the same way bigger companies can. This paper looks at two of the most prevalent data exfiltration methods utilized by threats from inside the company. This research will create and forensically examine two scenarios to determine if artifacts can be detected that provide evidence of data exfiltration.