RUNBOOK // Data Exfiltration & Staging Triage

SEVERITY 1 // CRITICAL DATA THEFT & EXTORTION Target Time to Contain: < 20 minutes

Data exfiltration is the defining phase of modern double-extortion ransomware and espionage campaigns. Prior to encrypting systems, adversaries compress high-value confidential data (financial records, source code, employee PII) into encrypted archives and upload them to cloud storage services (Mega.nz, Dropbox, Google Drive, Wasabi, or attacker-controlled S3 buckets) using CLI utilities like rclone, megasync, or PowerShell web requests.

---

⚡ Step 1: Immediate Egress Severing & Host Quarantine

If massive outbound network transfers are detected:

# Emergency Host Egress Severing via Local Windows Firewall
# Blocks all outbound network communication immediately while maintaining local forensic console
New-NetFirewallRule -DisplayName "EMERGENCY_DATA_EXFIL_BLOCK" -Direction Outbound -Action Block -Profile Any -Priority 1

---

🗜️ Step 2: Hunting Data Staging & Archiving Activity

Adversaries almost never exfiltrate raw uncompressed files. They aggregate and compress data into hidden directories using 7z.exe, rar.exe, or PowerShell.

1. KQL Query: Detecting Command-Line Archiving Tools

let Lookback = 7d;
let ArchiveTools = dynamic(["7z.exe", "7za.exe", "rar.exe", "winrar.exe", "tar.exe", "zip.exe"]);
DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where FileName in~ (ArchiveTools)
| where ProcessCommandLine has_any (" a ", " -hp", " -p", " -r", "cf ", "czf ")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, FolderPath
| sort by Timestamp desc

2. PowerShell Script: Locating Large Staged Archives on Disk

Scans common adversary staging grounds (%TEMP%, C:\ProgramData\, C:\PerfLogs\, C:\Users\Public\) for recently created archive files over 100MB:

# Hunt for suspicious archive files created in the last 48 hours
$searchRoots = @("C:\PerfLogs", "C:\ProgramData", "C:\Users\Public", "$env:TEMP")

Get-ChildItem -Path $searchRoots -Include *.zip,*.7z,*.rar,*.tar,*.gz -Recurse -File -ErrorAction SilentlyContinue |
    Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-2) -and $_.Length -gt 50MB } |
    Select-Object FullName, @{N='SizeMB';E={[math]::Round($_.Length/1MB, 2)}}, CreationTime, LastWriteTime |
    Format-Table -AutoSize

---

🌐 Step 3: Rclone & Cloud Storage Tool Triage

rclone is the #1 tool used by ransomware groups for exfiltration due to its ability to transfer multithreaded data directly to over 40 cloud providers.

1. Detecting Rclone Configuration Files (rclone.conf)

The rclone.conf file contains the attacker’s cloud credentials, bucket names, and API keys:

# Search entire drive for rclone configuration files
Get-ChildItem -Path C:\ -Filter "rclone.conf" -Recurse -Force -ErrorAction SilentlyContinue | ForEach-Object {
    Write-Warning "RCLONE CONFIG FOUND: $($_.FullName)"
    Get-Content $_.FullName | Select-Object -First 25
}

2. KQL Query: Hunting Outbound Connections to Cloud Storage Providers

let Lookback = 3d;
DeviceNetworkEvents
| where Timestamp > ago(Lookback)
| where RemoteUrl has_any (
    "mega.nz", "api.mega.co.nz", "wasabisys.com", "backblazeb2.com",
    "dropboxapi.com", "discord.com/api/webhooks", "transfer.sh"
)
| summarize
    TotalBytesSent = sum(TotalBytesSent),
    ConnectionCount = count(),
    FirstTransfer = min(Timestamp),
    LastTransfer = max(Timestamp)
  by DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP
| where TotalBytesSent > 50000000 // Greater than 50MB
| sort by TotalBytesSent desc

---

🔬 Step 4: Forensic Scoping with SRUM (System Resource Usage Monitor)

To determine how many total gigabytes an adversary exfiltrated after they have deleted their tools and logs, query Windows SRUDB.dat:

# Parse SRUM database to calculate exact exfiltrated byte count per binary
SrumECmd.exe -d "C:\Forensics\Triage\sru" --reg "C:\Forensics\Triage\config" --csv "C:\Forensics\Output"

In the resulting NetworkUsage.csv, filter for:

• Executables run from AppData, Temp, or Public.
• High values in BytesSent column ($> 1,000,000,000$ bytes = 1 GB).
• Network interface used (Wi-Fi vs Ethernet).

---

🛡️ Step 5: Post-Exfiltration Legal & Breach Scoping Checklist

[ ] Step 1: Identify all directory paths included in the archive command line.
[ ] Step 2: Inventory file types (PDF, XLSX, DOCX, SQL, BAK, CSV) inside targeted directories.
[ ] Step 3: Notify Corporate Legal and Privacy Officer regarding potential PII/Regulatory breach.
[ ] Step 4: Revoke API keys or compromise credentials discovered inside staged directories.
[ ] Step 5: Request domain/IP abuse takedown with hosting provider (e.g. Mega.nz or Cloudflare).