# Data Exfiltration

**ID**: S1001

**Description**: An employee is suspected of unauthorized copying of sensitive data (code, trade secrets, etc) from internal systems to those outside of the company's control.

## Are there any indications of anti-forensic efforts? <span class="dfiqIdTag">F1007</span>

 - <a href="/questions/Q1024"><span class="dfiqIdTag">Q1024</span> &nbsp;Was an Incognito/Private browser session used?</a>
 - <span class="dfiqIdTag">Q1028</span> &nbsp;Was there specialized "anti-forensic" (or "privacy") software on a computer?
 - <span class="dfiqIdTag">Q1029</span> &nbsp;Were any encryption programs used on a computer?
 - <span class="dfiqIdTag">Q1030</span> &nbsp;Were any security or monitoring agents tampered with or disabled?
 - <span class="dfiqIdTag">Q1032</span> &nbsp;What actions were taken in an Incognito (or "private") browser session?
 - <span class="dfiqIdTag">Q1033</span> &nbsp;Was shell history cleared?
 - <a href="/questions/Q1074"><span class="dfiqIdTag">Q1074</span> &nbsp;Were any system event logs cleared?</a>
## Are there signs of staging data for future exfiltration? <span class="dfiqIdTag">F1008</span>
"Staging" refers to the collection of data of interest onto a local system, as a precursor step for future exfiltration of that data. When reviewing data from Questions in this Facet, look for unusual volumes of results (number or size of files downloaded or sent, for example).

 - <a href="/questions/Q1001"><span class="dfiqIdTag">Q1001</span> &nbsp;What files were downloaded using a web browser?</a>
 - <span class="dfiqIdTag">Q1004</span> &nbsp;What screenshots were taken on a computer?
 - <span class="dfiqIdTag">Q1005</span> &nbsp;What files have ever been on a computer?
 - <span class="dfiqIdTag">Q1006</span> &nbsp;What files are present on a computer?
 - <span class="dfiqIdTag">Q1017</span> &nbsp;Were any files collected into a container?
 - <span class="dfiqIdTag">Q1034</span> &nbsp;Was content copied from a file?
 - <span class="dfiqIdTag">Q1035</span> &nbsp;Were any copies made of sensitive files?
 - <span class="dfiqIdTag">Q1077</span> &nbsp;Were there bulk downloads from Google Drive?
## Was any sensitive data sent externally via email? <span class="dfiqIdTag">F1009</span>

 - <span class="dfiqIdTag">Q1016</span> &nbsp;What files were sent externally via email attachments?
 - <span class="dfiqIdTag">Q1075</span> &nbsp;Is the recipient account controlled by the sender?
 - <span class="dfiqIdTag">Q1076</span> &nbsp;Were the files screenshots?
 - <span class="dfiqIdTag">Q1078</span> &nbsp;Were the files copies?
 - <span class="dfiqIdTag">Q1079</span> &nbsp;Is there a history of communication with the recipients?
 - <span class="dfiqIdTag">Q1080</span> &nbsp;How many external recipients does the email have?
## Was any sensitive data exfiltrated via a physical medium? <span class="dfiqIdTag">F1010</span>

 - <span class="dfiqIdTag">Q1003</span> &nbsp;What files were copied from a computer to a USB device?
 - <span class="dfiqIdTag">Q1010</span> &nbsp;What was printed from a computer?
## Was any sensitive data exfiltrated via a web service? <span class="dfiqIdTag">F1011</span>

 - <span class="dfiqIdTag">Q1007</span> &nbsp;What files were synced or backed-up to external services?
 - <span class="dfiqIdTag">Q1009</span> &nbsp;What interactions with external cloud storage sites did the actor have using their web browser?
 - <span class="dfiqIdTag">Q1011</span> &nbsp;What files were sent or received by a chat application?
 - <span class="dfiqIdTag">Q1025</span> &nbsp;What external accounts has the actor used in their web browser?
 - <span class="dfiqIdTag">Q1038</span> &nbsp;Were any files sent via CLI utilities?
 - <span class="dfiqIdTag">Q1084</span> &nbsp;What data was uploaded to a website via a web browser?
## System Information <span class="dfiqIdTag">F1012</span>

 - <span class="dfiqIdTag">Q1008</span> &nbsp;What programs are installed on a computer?
 - <span class="dfiqIdTag">Q1081</span> &nbsp;Does the user have a recently provisioned host?
## Were any files sent via other network media? <span class="dfiqIdTag">F1026</span>

 - <span class="dfiqIdTag">Q1082</span> &nbsp;Were any files sent via AirDrop?
 - <span class="dfiqIdTag">Q1083</span> &nbsp;Were any files sent via Bluetooth?
