Use Case: Data Exfiltration Detection

Potential Data Exfiltration Activity to an Unusual Destination Port

Jul 28, 2026 · Data Source: Elastic Defend Data Source: Network Packet Capture Use Case: Data Exfiltration Detection Rule Type: ML Rule Type: Machine Learning Tactic: Exfiltration Resources: Investigation Guide ·

Share on:

A machine learning job has detected data exfiltration to a particular destination port. Data transfer patterns that are outside the normal traffic patterns of an organization could indicate exfiltration over command and control channels.

Potential Data Exfiltration Activity to an Unusual IP Address

Jul 28, 2026 · Data Source: Elastic Defend Data Source: Network Packet Capture Use Case: Data Exfiltration Detection Rule Type: ML Rule Type: Machine Learning Tactic: Exfiltration Resources: Investigation Guide ·

Share on:

A machine learning job has detected data exfiltration to a particular geo-location (by IP address). Data transfers to geo-locations that are outside the normal traffic patterns of an organization could indicate exfiltration over command and control channels.

Potential Data Exfiltration Activity to an Unusual ISO Code

Jul 28, 2026 · Data Source: Elastic Defend Data Source: Network Packet Capture Use Case: Data Exfiltration Detection Rule Type: ML Rule Type: Machine Learning Tactic: Exfiltration Resources: Investigation Guide ·

Share on:

A machine learning job has detected data exfiltration to a particular geo-location (by region name). Data transfers to geo-locations that are outside the normal traffic patterns of an organization could indicate exfiltration over command and control channels.

Potential Data Exfiltration Activity to an Unusual Region

Jul 28, 2026 · Data Source: Elastic Defend Data Source: Network Packet Capture Use Case: Data Exfiltration Detection Rule Type: ML Rule Type: Machine Learning Tactic: Exfiltration Resources: Investigation Guide ·

Share on:

A machine learning job has detected data exfiltration to a particular geo-location (by region name). Data transfers to geo-locations that are outside the normal traffic patterns of an organization could indicate exfiltration over command and control channels.

Spike in Bytes Sent to an External Device

Jul 28, 2026 · Data Source: Elastic Defend Use Case: Data Exfiltration Detection Rule Type: ML Rule Type: Machine Learning Tactic: Exfiltration Resources: Investigation Guide ·

Share on:

A machine learning job has detected high bytes of data written to an external device. In a typical operational setting, there is usually a predictable pattern or a certain range of data that is written to external devices. An unusually large amount of data being written is anomalous and can signal illicit data copying or transfer activities.

Spike in Bytes Sent to an External Device via Airdrop

Jul 28, 2026 · Data Source: Elastic Defend Use Case: Data Exfiltration Detection Rule Type: ML Rule Type: Machine Learning Tactic: Exfiltration Resources: Investigation Guide ·

Share on:

A machine learning job has detected high bytes of data written to an external device via Airdrop. In a typical operational setting, there is usually a predictable pattern or a certain range of data that is written to external devices. An unusually large amount of data being written is anomalous and can signal illicit data copying or transfer activities.

Unusual Process Writing Data to an External Device

Jul 28, 2026 · Data Source: Elastic Defend Use Case: Data Exfiltration Detection Rule Type: ML Rule Type: Machine Learning Tactic: Exfiltration Resources: Investigation Guide ·

Share on:

A machine learning job has detected a rare process writing data to an external device. Malicious actors often use benign-looking processes to mask their data exfiltration activities. The discovery of such a process that has no legitimate reason to write data to external devices can indicate exfiltration.