Lion Cipher Lab
Detect data exfiltration from network flow logs (build the volumetric analytic from scratch)
- SOC Analyst / Blue Team
- Advanced
- ~80 min
- Free · no account required
Why it matters
Almost every breach that makes the news ends the same way: data leaves. Attackers break in for the data, and at some point they have to move it off your network -- to a cloud bucket, a paste site, a server they rent, a C2 channel. That moment is one of your last and best chances to catch them, because unlike the quiet early stages, exfiltration usually MOVES VOLUME and moves it SOMEWHERE NEW. The beautiful thing for a defender is that you do not need to read the stolen files to see this happening: a NETWORK FLOW LOG -- a per-connection summary of who talked to whom, on what port, and how many…
What you'll learn
- what data exfiltration is, and reading a network FLOW LOG (per-connection rows: who talked to whom, on what port, how many bytes each way, for how long)
- the three independent axes of exfil detection and how this lab differs from its siblings: beaconing hunts the RHYTHM of callbacks, DNS-tunneling hunts the covert CHANNEL, and THIS lab hunts VOLUME + DESTINATION + TIMING
- generating a self-contained benign baseline (browsing plus a legit nightly cloud backup) and four labelled needles as pure CSV test-data on your own machine (nothing is sent)
- building a per-host bytes_out baseline and scoring deviations with a z-score, instead of a naive absolute-volume threshold
- the signals that actually separate exfil from noise: rare/never-before-seen destination ASN or country, off-hours timing, out:in asymmetry ratio, and collection-then-egress staging correlation
- why raw bytes_out alone flags a legit cloud-backup job as loudly as real exfil, and how a rare-destination + per-host-baseline gate kills that false positive
- aggregating many sub-threshold uploads to catch a transfer deliberately chunked under a size limit, and correlating an internal collection event with a later egress to catch staging
- the judgment of WHEN volumetric flow analysis beats deep packet inspection (it works on ENCRYPTED traffic), WHY it is noisy, and HOW pros productionize it with Zeek conn.log / NetFlow-IPFIX collectors feeding a SIEM, DLP, and egress filtering
Steps in this lab
- What exfiltration is, what a flow log is, and the axis this lab hunts
- Generate a self-contained flow log: a benign baseline plus four needles
- Build the detector (part 1): learn each host's baseline and the known destinations
- Build the detector (part 2): score, correlate staging, aggregate chunks, report
- Run it and watch the needles rise while the backup stays quiet
- The --naive round: why raw volume alone drowns you in the backup
- Map every needle to ATT&CK, and why this is the third axis of exfil detection
- The judgment: when volumetric flow analysis wins, why it is noisy, and how pros ship it