SOP-07: Data Exfiltration & DLP Alert Response

Data exfiltration is the unauthorized transfer of sensitive data from an organisation's environment to an external or unapproved destination. It covers both intentional insider theft and attacker-driven extraction following a breach. DLP (Data Loss Prevention) tools detect this by inspecting content, volume, destination, and data labels.

Common attacker objectives: sell customer PII, steal intellectual property, stage data for ransom leverage, extract credentials/config for further compromise, exfiltrate before deploying ransomware (double-extortion).

Five questions. Any YES triggers deeper investigation. All NO = probable FP, log and close.

• 1
  Is the destination external (outside corporate IP space, not a known partner domain, not corporate OneDrive/SharePoint)? Internal-to-internal transfers are almost never exfiltration.
• 2
  Does the volume exceed 50MB or 500+ files in a single session? Small one-off uploads are almost always FP.
• 3
  Is the data classified as Confidential, PII, Financial, or IP? Check Purview label in the DLP alert details.
• 4
  Is the user a departing employee, in a disciplinary process, or recently switched roles? Check HR system or manager confirmation — high-risk indicator.
• 5
  Did the source device have a prior malware or C2 alert in the last 48 hours? If yes — this is attacker-driven exfil. Escalate immediately (SOP-05).

Pull the full picture of what was transferred: file names, sizes, types, destination, and the process that initiated the transfer. Replace USER_UPN and DEVICE_NAME from the alert.

The initiating process tells you whether this was a user action (browser, Office) or an automated tool (rclone, curl, PowerShell, custom script). Automated tools = high-confidence TP or attacker tool.

Compare today's upload volume against the user's 30-day baseline. Anomalous spike = high-confidence TP. Consistent pattern = probable FP or authorized tool.

Stop the active transfer first, before touching the account. If the upload is still in progress, every second matters.

• 1
  Block destination domain/IP in Defender: security.microsoft.com → Settings → Endpoints → Indicators → URLs/IP addresses → Add indicator → Block and alert. Add the destination domain (e.g. dropbox.com if personal account) with comment referencing incident number.
• 2
  Block app in Defender for Cloud Apps: security.microsoft.com → Cloud Apps → Cloud app catalog → Find app → Tag as Unsanctioned — this pushes a block to all Defender-enrolled endpoints automatically.
• 3
  Isolate the device to cut all external connectivity: security.microsoft.com → Assets → Devices → [device] → Isolate device → Full isolation. Use only when transfer is confirmed active — isolation will interrupt the user's session.

• 1
  Revoke all active sessions: portal.azure.com → Entra ID → Users → [user] → Revoke sessions — kills browser sessions, OAuth tokens, refresh tokens.
• 2
  Block sign-in: Users → [user] → Edit → Account enabled → NO → Save
• 3
  Revoke OAuth consent grants (attacker may have added a malicious app): Entra ID → Enterprise Applications → [user's consented apps] → Permissions → Review and revoke suspicious grants
• 4
  Block external sharing in SharePoint/OneDrive if the user used corporate storage for staging: admin.microsoft.com → SharePoint admin → Policies → Sharing → Set external sharing to "Only people in your organization" — apply at tenant level if multiple users affected.

• 1
  Place Microsoft Purview Litigation Hold on the user's mailbox: compliance.microsoft.com → Data lifecycle management → Retention policies → or per-mailbox hold via Exchange admin
• 2
  Collect investigation package from Defender XDR before any cleanup: Assets → Devices → [device] → Collect investigation package
• 3
  Export DLP audit log from Purview: compliance.microsoft.com → Audit → Search → filter by user and date range → Export results

• 1
  Open Live Response on the affected device: security.microsoft.com → Assets → Devices → [device] → Initiate Live Response session
• 2
  Remove any unauthorized exfil tools found in I3: remediate file "C:\Users\user\Downloads\rclone.exe"
• 3
  Delete staged archive files from Temp/Desktop: run cmd /c "del /f /q C:\Users\user\Desktop\*.zip"
• 4
  Check and remove any scheduled tasks that automate the exfil: run scheduledtasks → look for tasks running rclone, curl, or PowerShell with upload commands → remediate scheduledtask "task-name"
• 5
  Check browser saved credentials for the destination service (attacker may have added): run autoruns → review browser extensions and credential stores.

• 1
  Patch or harden the transfer path: If personal cloud was used — enforce Cloud App Control policy in MDA to block all personal cloud storage accounts tenant-wide. If USB — enforce Device Control policy in Defender: security.microsoft.com → Settings → Endpoints → Device control
• 2
  Update DLP policy to add the file types and destination patterns found: compliance.microsoft.com → Data loss prevention → Policies → [policy] → Edit → add matched conditions
• 3
  Assess data at risk: Enumerate what was transferred — file names, data types, record counts if PII. This feeds the legal/regulatory notification decision.

Document the full exfiltration timeline before closing. This is required for regulatory notification and legal proceedings.

• 1
  Cannot determine FP vs TP within 30 minutes
• 2
  Volume confirmed above 50MB to an external destination
• 3
  Automated exfil tool detected (rclone, curl, PowerShell upload script)
• 4
  User is a departing employee or in a disciplinary process
• 5
  Source device had a prior malware alert — attacker-driven exfil suspected

• 1
  Sensitive/classified data confirmed exfiltrated (not just staged)
• 2
  Malicious insider confirmed — intent supported by evidence (keyword searches, prior warnings, resignation timing)
• 3
  Exfil tied to an active breach — source device compromised by external attacker
• 4
  Volume exceeds 500MB or 5,000+ records