logo
Defence blues
The data egress hunt
  • Red tradecraft
  • Privacy greenhouse
  • Purple crossroads
  • Indigo observatory
  • Contact
Initializing search
    • Blue team @Home
    • Servers without a security team
    • Honeytech for humans
    • Blue team for dev
    • OT and ICS security
    • Counter moves
      • Closing the doors just walked through
      • The machine at the point of impact
      • Traffic patterns as evidence
      • Inter-domain routing as a target
      • The surface designed to be accessible
      • The application layer as a target
      • Infrastructure you defend but do not own
      • Where the container meets the host
      • Systems that were never meant to be networked
      • The domain as an attack graph
      • The gap between access and authority
      • Harvesting stored secrets
      • Surviving the reboot
      • From target to target
      • Plausibility as cover
      • Memory corruption and its limits
      • Watching data being gathered
      • Watching the exits
        • Exfiltration: defender context
        • Detecting exfiltration
        • Steganography
        • ML-based steganalysis
        • Detecting AI-generated steganography
        • Network and behavioural detection
        • The data egress hunt
          • Exfiltration hunting
          • Runbook: analysing images for hidden content
          • Runbook: network traffic analysis for steganographic channels
          • Runbook: investigating suspected steganographic exfiltration
        • The data egress hunt
          • Exfiltration hunting
          • Runbook: analysing images for hidden content
          • Runbook: network traffic analysis for steganographic channels
          • Runbook: investigating suspected steganographic exfiltration
      • Limiting the blast radius
      • Operational cost of security controls
    • Golem Trust Computing Ltd.
    • Civic Defence Establishment
    • The Circle Sea Arrangement
    • Office of Civil Surveys
    • Civil Observers’ Society
    • The Home for Bewildered Beasts of Legend
    • Campaigns, manoeuvres and scenarios
    • Taking back the stack

    The data egress hunt¶

    Runbooks for hunting data leaving the environment through unusual channels or volumes, including DNS tunnelling, cloud storage abuse, and anomalous outbound traffic patterns.

    • Exfiltration hunting
    • Runbook: analysing images for hidden content
    • Runbook: network traffic analysis for steganographic channels
    • Runbook: investigating suspected steganographic exfiltration
    2026-09-29 19:56
    Previous
    Network and behavioural detection
    Next
    Exfiltration hunting
    © Copyright 2026, TyMyrddin.
    Created using Sphinx 7.2.6. and Sphinx-Immaterial · Made with love by Ty Myrddin, 2026, with a forest garden fostered by /ut7