4 ms·
Assuming the exfiltration can be differentiated from normal behavior!
by drb91 7y ago
Assuming the exfiltration can be differentiated from normal behavior!
- auiya 7y agoSeeing large amounts of encrypted traffic leaving via a DNS tunnel during non-standard business hours for instance would be an example of such an anomaly. It's not always that easy to detect however.