Monitor for unusual data egress volumes, off-hours access to sensitive repositories, and the creation of hidden archives. Correlate these signals with process lineage to distinguish legitimate backups from theft. Focus on behavioural anomalies rather than known malware signatures to catch novel extortion attempts early.
The Silence Before the Storm
Data extortion rarely begins with a ransom note. It starts with stealth. Attackers need to gather enough sensitive information to make the threat credible before they lock systems or demand payment. This phase is quiet, methodical and often invisible to standard security tools that look for known malware. You are looking for the preparation, not the execution. The goal is to spot the movement of data before it leaves the network or is encrypted.
Imagine a scenario where an attacker gains access to a single workstation. They do not immediately deploy ransomware. Instead, they spend weeks mapping the network, identifying sensitive files and establishing persistence. This patience is their greatest advantage and your biggest blind spot. If you only look for the final lock, you have already lost the window for prevention.
Network Egress Anomalies
The most reliable indicator of data theft is the movement of data across your perimeter. However, you must distinguish between normal business traffic and exfiltration. Look for spikes in outbound data volume, particularly during non-business hours. Attackers often throttle their transfers to blend in with background noise, but the aggregate volume usually tells a different story.
Check for connections to unfamiliar external IP addresses. Even if the traffic is encrypted, the destination matters. A sudden connection to a cloud storage service from a server that normally only communicates with internal databases is a red flag. Monitor for large uploads to personal cloud accounts or file-sharing services. These platforms are often used as staging areas before data is moved to a final destination.
| Signal | Where to look | What it may mean |
|---|---|---|
| High outbound volume | Firewall logs, NetFlow | Bulk data exfiltration |
| New external destinations | DNS logs, proxy logs | Communication with command and control |
| DNS tunneling | DNS query logs | Covert data exfiltration via domain names |
| Unusual protocol use | Network packet captures | Bypassing standard security filters |
Endpoint Process Lineage
Attackers often use legitimate system tools to move data. This technique, known as living off the land, avoids triggering alerts for unknown executables. You need to look at what processes are doing, not just what is running. PowerShell, RDP and SSH are common tools for administrators, but they are also favourite tools for attackers.
Focus on process lineage. If a web browser spawns a command prompt, which then spawns an archive utility, that is highly suspicious. Browsers should not be executing system commands. Similarly, look for the creation of compressed archives. Attackers compress data to reduce the size of the exfiltration stream. The creation of large ZIP, TAR or RAR files on endpoints that do not normally handle such tasks is a strong signal.
File System and Access Patterns
Data does not move without being touched. File access logs are a goldmine for detecting extortion. Look for mass access events where a single user or process reads hundreds of files in a short period. Normal users open files individually. Attackers script this process to gather data quickly.
Pay attention to the types of files being accessed. If an engineering workstation starts accessing HR databases or financial records, something is wrong. Cross-reference this with your data classification scheme. Accessing high-value assets from low-privilege accounts is a violation of least privilege principles. Also, look for the creation of new files in temporary directories. Attackers often stage stolen data in temp folders before moving it elsewhere.
Identity and Privilege Abuse
Extortion requires access. Attackers will try to escalate their privileges to reach sensitive data. Look for unusual login patterns, such as logins from new geographic locations or at odd hours. More importantly, look for privilege escalation. If a standard user account suddenly gains administrative rights, investigate immediately.
Check for the creation of new user accounts. Attackers often create backdoor accounts to maintain access even if their initial foothold is discovered. These accounts may have generic names or be hidden in system directories. Monitor for changes to group memberships. Adding a user to a privileged group is a clear sign of intent to access more data. Refer to our guide on stolen session tokens for details on how attackers bypass login scrutiny entirely.
See also: Vendor Patch Cycles: Why Timing Dictates Your Security Posture · Detection Engineering: A Practical Step-by-Step Implementation Plan
Blind Spots in Detection
Most security teams focus on the perimeter and the endpoint. They forget about the middle. Cloud storage and collaboration platforms are often overlooked. Attackers may upload data to a corporate OneDrive or SharePoint account before exfiltrating it. If your monitoring stops at the firewall, you miss this internal movement.
Another blind spot is encrypted traffic. If you do not inspect SSL/TLS traffic, you cannot see what is happening inside the tunnel. However, inspection has privacy implications and performance costs. You must balance visibility with user trust. A third blind spot is the human element. Insiders may facilitate extortion. If you only look for external threats, you miss the insider threat.
Tooling and Correlation
No single tool will catch every signal. You need a combination of network monitoring, endpoint detection and identity management. Security Information and Event Management (SIEM) systems are critical for correlating these disparate signals. A firewall alert alone is noise. A firewall alert combined with an unusual process execution and a privilege escalation is a pattern.
Use User and Entity Behaviour Analytics (UEBA) to establish baselines. UEBA helps you distinguish between a busy analyst working late and an attacker moving data. It learns what is normal for each user and device. When deviations occur, it raises an alert. Integrate these tools to create a unified view of your environment. Without correlation, you will drown in false positives.
The Human Factor in Detection
Automated tools are only as good as the humans who interpret them. Analyst fatigue is a real problem. If you are bombarded with low-value alerts, you will miss the high-value ones. Tune your alerts to reduce noise. Focus on high-fidelity signals that require immediate investigation.
Training is also vital. Your team needs to understand the tactics of extortion. They need to know what to look for and how to respond. Regular tabletop exercises can help prepare your team for the real event. Ensure that your incident communication plans are up to date. When extortion happens, communication is as important as containment.
Key takeaways
- Exfiltration often uses legitimate administrative tools to bypass security controls
- Network metadata reveals data movement even when payloads are encrypted
- Behavioural baselines are more effective than static rules for detecting theft
Data extortion is a process, not an event. Detecting it requires monitoring for behavioural anomalies across network, endpoint and identity layers. Start by baselining normal activity and alerting on deviations from that norm.
Frequently asked questions
How do I distinguish between a backup and data exfiltration?
Backups follow a predictable schedule and pattern. Exfiltration is often irregular, occurs at odd hours and involves specific high-value files rather than full system images.
How often should I review my detection rules?
Review and tune your rules regularly, at least quarterly. Attackers change their tactics, and your environment evolves. Static rules become ineffective over time.
How this guide was produced: written by the Breach Observer editorial team with AI assistance, checked against the public references listed below, and reviewed when the facts change. See our editorial policy or report an error.