Kill Chain — Exfiltration Agent Response

When this fires: exfiltration_agent detected large outbound transfer to a new destination (>500 MB for PROD, >100 MB for DDE), known exfil tool detected by Palo Alto App-ID (rclone, winscp, mega.nz, dropbox, box), or large after-hours transfer (>100 MB outside 06:00–20:00 PST).

Severity: HIGH by default. CRITICAL if App-ID matched a known exfil tool.

MITRE: T1048 (Exfiltration Over Alternative Protocol), T1567 (Exfiltration Over Web Service)

---

Immediate Triage — Within 10 Minutes

1. Open SecOps finding. Note: source IP, destination IP/domain, bytes transferred, App-ID (if available), timestamp
2. Determine detection subtype:
   • large_transfer_new_destination — volume threshold exceeded, destination not seen in 30 days
   • exfil_tool_detected — App-ID matched rclone, winscp, mega.nz, etc. → CRITICAL path
   • after_hours_large_transfer — volume threshold exceeded outside business hours
3. Check CM tickets — is this a legitimate backup job (Veeam to AWS S3) or software deployment?
   • Veeam backup to AWS: source IP = Veeam backup server, destination = AWS S3 IP ranges
   • Software deployment: check Intune for active Windows Update or application deployment
4. Is the source IP an internal host or a known cloud workload?

---

Investigation KQL

// Transfer history for the source IP over the last 24 hours
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor == "Palo Alto Networks"
| where SourceIP == "<source_ip>"
| summarize TotalBytesSent = sum(SentBytes), TotalBytesReceived = sum(ReceivedBytes),
    Destinations = make_set(DestinationIP), Apps = make_set(ApplicationProtocol)
    by bin(TimeGenerated, 1h)
| order by TimeGenerated desc

// Was this destination seen in the prior 30 days?
CommonSecurityLog
| where TimeGenerated > ago(30d) and TimeGenerated < ago(4h)
| where DeviceVendor == "Palo Alto Networks"
| where DestinationIP == "<destination_ip>"
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Count = count()

// App-ID for exfil tools across all sources
CommonSecurityLog
| where TimeGenerated > ago(4h)
| where DeviceVendor == "Palo Alto Networks"
| where ApplicationProtocol has_any ("rclone", "winscp", "mega", "dropbox", "box", "filezilla", "ftp")
| project TimeGenerated, SourceIP, DestinationIP, SentBytes, ReceivedBytes, ApplicationProtocol
| order by SentBytes desc

// What process was running on the source host during the transfer?
SecurityEvent
| where TimeGenerated > ago(4h)
| where Computer has "<hostname>"
| where EventID == 4688
| where TimeGenerated between (datetime(<transfer_start>) .. datetime(<transfer_end>))
| project TimeGenerated, NewProcessName, CommandLine, ParentProcessName, Account

---

Containment — App-ID Exfil Tool Detected (CRITICAL)

Known exfil tools (rclone, mega.nz, winscp) have no legitimate use in this environment. Treat as confirmed exfiltration.

1. Block the source host's outbound traffic at the firewall:

   • Panorama → Policies → Security → add outbound deny rule for source IP
   • Or: isolate the host via Cortex XDR → the isolation blocks all network traffic

2. Isolate the host via Cortex XDR if not already done

3. Identify what the tool was uploading:

   • Check the command line arguments from the 4688 KQL above — rclone command lines often include the source path
   • Check Palo Alto session data for the full data volume

---

Containment — Large Transfer to New Destination

1. Check if the transfer is still in progress via current Palo Alto session table (Cortex XDR → Investigate → Live Terminal, or Panorama → Monitor → Session Browser)
2. If ongoing: block the destination IP at Palo Alto immediately
3. If complete: document the full data volume and destination

---

PHI Exposure Assessment

This is the most critical step for compliance. Answer:

1. What was on the source host? Check Intune/CMDB for the machine — is it an ePHI workstation?
2. What paths did the transfer tool access? (from process arguments or file access logs)
3. Does the destination correlate with any known BA or cloud storage? Or is it unknown?
4. Was this from the DDE environment? Any transfer from DDE is especially sensitive — the DDE environment hosts the Medicare/PHI app

DDE environment exfiltration = confirmed potential breach. Initiate breach risk assessment immediately per compliance/hipaa-breach-notification-procedure.md.

PROD environment: if the source host had access to psql-secops-prod, Azure storage with ePHI, or SharePoint with PHI — initiate breach risk assessment.

---

Escalation

Condition	Action
Large transfer, confirmed backup/deployment	Document, no escalation, add known-good rule
App-ID exfil tool detected	Rory + Arctic Wolf immediately, isolate host
DDE environment transfer to unknown destination	Rory + Adriana (breach notification path) + Arctic Wolf
Active ongoing transfer	Block at firewall first, then escalate

---

Post-Incident Checklist

• [ ] Transfer stopped (host isolated or destination blocked)
• [ ] Full data volume quantified (bytes transferred, file types if determinable)
• [ ] Source host investigation complete
• [ ] PHI exposure assessed — breach notification determination made
• [ ] Palo Alto App-ID and URL filtering rules updated if a new exfil vector was identified
• [ ] M365 DLP rules reviewed if SharePoint/OneDrive was involved (runbooks/m365-dlp-operations.md)
• [ ] HIPAA breach assessment documented in SecOps

---

Related Documents

• runbooks/kill-chain-execution-response.md — exfiltration is usually a late-stage activity after earlier execution
• compliance/hipaa-breach-notification-procedure.md — mandatory if PHI was involved
• runbooks/m365-dlp-operations.md — DLP rules for SharePoint and OneDrive
• security/palo-alto-overview.md — Palo Alto firewall operations
• runbooks/panorama-day-to-day.md — Panorama CLI and policy management