Every breach that lands a CISO in front of the board has a common final act: Data leaving the building. Attackers don't get paid for breaking in. They get paid for what they take out. And by the time stolen data appears on an extortion site or in a regulator's inbox, the window to stop the damage has already closed.
That is what makes exfiltration so dangerous. It rarely looks like an emergency. It hides inside routine protocols, blends with normal traffic, and slips past tools tuned to detect the intrusion but not the exit. This post breaks down what data exfiltration really looks like, how Corelight Sensor release v29.2 detects it with on-sensor anomaly detection, and how Corelight turns network evidence into early, defensible action.
Data exfiltration is the unauthorized transfer of data from a computer, server, or network. It's the moment sensitive information, such as intellectual property, customer records, financial data, or credentials, moves from inside your control to somewhere outside it. For a CISO, it's the difference between a contained incident and a reportable breach.
Skilled adversaries prefer channels you already trust, because those channels rarely get continuous scrutiny. The most common vectors for exfiltrating data include:
The pattern is consistent: Attackers exploit the gaps between tools rather than the tools themselves.
Understanding motivation helps you prioritize risk. Exfiltration is typically driven by:
When data leaves, the consequences land squarely on the executive team. Exfiltration leads to direct data loss, regulatory non-compliance under frameworks like SEC disclosure rules, DORA, and NIS2, and measurable financial damage. It's also the leverage behind modern ransomware: Attackers steal first, encrypt second, and demand payment to keep your data off the open market.
Here's where evidence changes the equation. In one case, a Corelight customer used complete network visibility to prove that data being held for a $10 million ransom had no real value. That ground truth gave them the confidence to refuse the payment. Knowing exactly what left your network is the foundation of every defensible decision that follows.
Signature-based detection catches known threats. But exfiltration often looks novel, and that's precisely the point. Corelight Sensor v29.2 introduces an unsupervised machine-learning anomaly-detection model for unusually large outbound data transfers, adding to an already impressive set of anomaly detections relevant to both data exfiltration and the other stages of an attack.
The anomaly engine runs directly on the Corelight Sensor, with no additional hardware and no costly cloud analytics required. It uses machine learning to analyze behavior from network data, and retrains nightly to keep baselines current. For a CISO managing flat budgets, this matters: You gain a new detection layer on infrastructure you already own without inflating total cost of ownership.
The engine uses a default 31-day learning period to model normal network behavior before it generates a single alert. That patience pays off. Instead of reacting to arbitrary thresholds, the system understands your environment's genuine rhythm, so the anomalies it surfaces carry real weight.
Alert fatigue is a strategic problem, not just an operational one. Corelight's engine places users and devices into peer groups based on similar activity. An alert fires only when behavior looks anomalous to both the individual entity and its peer group. The result is high-confidence detections that respect your analysts' time and reduce burnout.
Release v29.2 ships with anomaly detection use cases built for the behaviors that precede data theft:
It also builds on anomaly detections already shipping, which cover behaviors seen before and during exfiltration.
Each detection produces a log that appears as an alert in Corelight Investigator and can flow to your SIEM, SOAR, or XDR. Corelight also generates context logs showing network behavior immediately before and after the anomaly, giving your team the story, not just the snapshot. When you need to tune, administrators can safelist specific hosts or IP ranges without disabling the detection entirely.
Although this discussion started with anomaly detection, it is only one layer. Corelight surrounds it with additional detection layers, including supervised ML models and behavioral detections, which combine with deep protocol visibility and open integrations to ensure exfiltration has nowhere to hide.
Alongside the new and existing anomaly engine detections, Corelight uses pre-trained supervised ML models to identify known exfiltration behaviors, including emerging threats that use variations on those behaviors:
Corelight's foundation is the open-source Zeek® engine, which parses dozens of protocols into structured, interconnected logs. Zeek assigns a unique Connection UID and File UID to track files as they move across connections and protocols. Zeek also has a built-in framework for writing rules that detect behavioral TTP-based activity. Corelight subscriptions include access to Corelight Collections, offering packages of Zeek-based behavioral detections and log enrichments.
Suricata adds signature-based IDS alerts, threat intelligence offers a feed of IOCs, and a YARA engine performs static file analysis. Fused together by the Connection UID, these create a single, correlated timeline of suspicious activity and bolster anomaly and supervised ML-generated alerts with evidence you can stand behind.
Attackers hide in encryption, assuming you can't see inside. One of the available Corelight Collection packages is the Encrypted Traffic Collection, which delivers insight into SSL, SSH, and RDP connections without decryption, including JA3 client fingerprinting to expose potential covert channels. You get visibility into the traffic most tools treat as a black box.
Exfiltration isn't confined to the data center. Corelight Cloud Sensors integrate with cloud control-plane data to detect cloud-specific threats, including unauthorized exfiltration from storage services like Amazon S3. The platform can also extract more than 200 file types directly from network traffic, letting your team verify the exact scope of what was taken and recover the actual files for analysis.
Corelight is built to strengthen the stack you already run:
This is the vendor-consolidation story CISOs need: A platform that enhances existing investments and reduces total cost of ownership rather than adding another silo.
Corelight Investigator transforms triage from a manual process into an automated, agent-driven workflow. Rather than simply using AI to explain individual detections, Investigator acts as an intelligent assistant that autonomously investigates and correlates related events across the network. By performing the heavy lifting of evidence gathering and analysis, it provides analysts with actionable summaries and clear next steps. This shift to agentic triage allows teams to move beyond isolated alerts to a unified understanding of activity, significantly improving mean time to detect (MTTD) and mean time to respond (MTTR).
Exfiltration detection shouldn't depend on hope or hindsight. Map your current visibility against the Corelight arsenal of protection described above, across DNS, SMB, HTTP, and ICMP protocols, and ask where your existing tools go quiet. Then see how Corelight closes those gaps with layered detection and audit-ready evidence.
Book a Corelight demo and bring along your toughest exfiltration scenario. We'll show you how to catch it before it becomes a breach you have to disclose.