Proving What Was Exfiltrated

Try it out loud first. Then check yourself:

1. Notification depends on what left, not just what was reachable; missing logs are not evidence that nothing left.
2. Staging: archivers (7z, rar) in Prefetch/Amcache, and $UsnJrnl records of archives created then deleted.
3. Transfer: SRUM per-process bytes sent, proxy/firewall byte counts, and tool traces such as rclone configs or MEGA endpoints.
4. SaaS/cloud: M365 MailItemsAccessed, SharePoint FileDownloaded, S3 data events; check each was licensed/enabled before the incident.
5. Bound the dataset by comparing egress volume to staged archive sizes; leak-site samples can confirm specific files.

If the interviewer pushes back

• Egress went over TLS to a cloud storage provider and you only have NetFlow. How confidently can you scope it, and how do you word that for legal?

Go deeper

• attack.mitre.org/techniques/T1560/001/
• attack.mitre.org/techniques/T1567/002/