## Exercise: Data Exfiltration (T1048)

**Objective**: Detect data leaving the network.

### The Attack
*   **Command**: Compress a folder into a ZIP and send it to an external FTP/HTTP server.
*   **Atomic**: `7z a -t7z -mx=9 stolen_data.7z C:UsersPublicSecrets*`

### The Detection
1.  **Archiving**: Event 4688 (Process Create) -> `7z.exe` or `rar.exe` or `tar.exe`.
    *   *Suspicious*: Running from a Temp directory.
2.  **Network**: Firewall allow log to a non-business IP.
    *   High Upload volume (> 10 MB).

### SIEM Search
`index=firewall action=allow bytes_out > 10000000 dest_port NOT IN (80, 443)`
(Looking for FTP, SSH, or odd ports).

### The Fix
*   Block outbound connections on servers by default.
*   Alert on large archive creation.