Use Case: Data & Insider
Data exfiltration detection
230 GB uploaded to a personal Dropbox account at 1:30 AM from a developer who put in their notice last Tuesday. ManySignal connected the dots before the archive finished uploading.
The exfiltration that DLP missed
Traditional DLP tools scan file content at egress points — email gateway, web proxy, endpoint agent. They catch documents with credit card numbers or SSN patterns. They miss compressed archives of source code, database exports without PII fields, and rclone transfers to cloud storage using API tokens instead of a web browser.
ManySignal combines DLP content signals with behavioral analysis and entity context: is this user departing? Did they recently change their file access patterns? Is the destination a personal cloud account rather than a business partner? The combination catches what content-only DLP cannot.
rule: data_exfiltration_behavioral
type: correlation + dlp
sources:
- netflow / proxy_logs
- endpoint_file_events (crowdstrike, mde)
- microsoft_purview / google_dlp
- hr_system (departing_status)
trigger:
- OR:
- condition: outbound_transfer_volume > user_baseline_p95 * 3
- condition: process IN [rclone, mega, curl, wget] AND external_upload
- condition: dlp_policy_match AND destination_type == personal_cloud
enrichments:
- data_classification: purview, nightfall
- destination_reputation: virustotal, proxy_category
- hr_status: departing_employee, pip_status
- insider_risk_score: 90d_behavioral_delta
mitre: T1048 (Exfiltration Over Alternative Protocol), T1567 (Exfil Over Web Service)What volume of data was transferred, to which external destination, and over what protocol?
NetFlow / DLPIs the destination IP or domain associated with known exfiltration infrastructure?
Threat intelDid the user compress or archive the files before transfer (zip, tar, 7z, rclone)?
EDR process logDoes the data volume exceed the user's 90-day baseline for external transfers?
Behavioral baselineWhat data classification applies to the transferred files?
DLP / PurviewIs there an approved business justification for this transfer in the DLP exemption list?
DLP policyIs this user on an HR watch list or a known departing employee?
HR integrationBlock the outbound transfer at the proxy or CASB layer if in progress
Approve-gatedCapture NetFlow records and proxy logs for forensic analysis
AutonomousNotify the user's manager and HR business partner
AutonomousPlace a 30-day DLP watch on the user account
Approve-gatedIf regulated data confirmed: notify legal and initiate breach assessment
RecommendLegacy SOC comparison
DLP fires on the content match but has no behavioral context. The analyst sees "file uploaded to Dropbox" with no information about the user's HR status, the file's data classification, or the volume relative to the user's baseline. Two-thirds of DLP alerts are dismissed as false positives. The actual insider exfiltration gets the same treatment.
MITRE ATT&CK mapping
Data exfiltration FAQ
Can ManySignal detect exfiltration over encrypted channels?
ManySignal uses metadata analysis for encrypted channels — destination IP, transfer volume, timing, and SNI hostname — combined with endpoint process telemetry showing which process initiated the connection. Tools like rclone and Mega.io have distinct behavioral signatures even when the payload is encrypted.
What data classification systems does ManySignal integrate with?
Microsoft Purview, Google Cloud DLP, Nightfall, Forcepoint DLP, Symantec DLP, and custom regex/fingerprint classifiers. ManySignal also imports Macie findings for S3 data and uses file extension heuristics as a fallback.
How does ManySignal differentiate legitimate large file transfers from exfiltration?
The behavioral model considers: destination (known business partner vs. consumer cloud storage), timing (business hours vs. midnight), data type (operational logs vs. customer PII), and whether the transfer method matches the user's historical tooling. All four factors combine into a risk score.
Does this cover exfiltration via DNS tunneling or ICMP covert channels?
DNS tunneling is a separate detection (see the DNS tunneling use case). ICMP covert channel detection is included in the network anomaly ruleset. Both can be linked to the same case via the entity graph if the same user or host is involved.
Catch exfiltration while the transfer is still in progress
Behavioral DLP that combines content, context, and entity risk into a single actionable alert.