CriticalALERT-4209engine: heuristic

Sensitive Data Egress Over HTTPS

analyst review

Raw alert — normalized QRadar offense

asset: mail-relay-01
protocol: DNS :443
src_ip: 10.22.7.99
dest_ip: 10.20.5.9
magnitude: 8/10
severity: 9/10
credibility: 5/10
relevance: 7/10
src network: internal_corp
events / flows: 4,671 / 5,873

triggered rules

▹ Exfil: Abnormal Outbound Data Volume
▹ Exfil: High Entropy DNS Queries

full offense JSON

{
  "offense_id": 4209,
  "description": "Sensitive Data Egress Over HTTPS :: Data Exfiltration targeting mail-relay-01",
  "offense_type": "Source IP",
  "offense_source": "10.22.7.99",
  "magnitude": 8,
  "severity": 9,
  "credibility": 5,
  "relevance": 7,
  "status": "OPEN",
  "source_network": "internal_corp",
  "destination_networks": [
    "internal_corp"
  ],
  "event_count": 4671,
  "flow_count": 5873,
  "start_time": "2025-11-03T12:05:00+00:00",
  "last_updated_time": "2025-11-03T12:43:00+00:00",
  "categories": [
    "Data Transfer",
    "Potential Data Loss/Theft"
  ],
  "rules": [
    "Exfil: Abnormal Outbound Data Volume",
    "Exfil: High Entropy DNS Queries"
  ],
  "assigned_to": null,
  "dest_port": 443
}

AI triage

Likely data exfiltration: Sensitive Data Egress Over HTTPS from internal host 10.22.7.99 against mail-relay-01 (10.20.5.9) over DNS, 4,671 events observed.

MITRE ATT&CK

T1048Exfiltration Over Alternative ProtocolExfiltrationconfidence 79%

Alert indicators (Sensitive Data Egress Over HTTPS; rules: Exfil: Abnormal Outbound Data Volume) overlap most strongly with T1048 Exfiltration Over Alternative Protocol among the ATT&CK shortlist.

Priority — Critical

Scored Critical based on: QRadar magnitude 8/10; high severity (9/10); data exfiltration pattern indicates likely post-compromise activity.

Recommended next steps

1.Quantify the outbound volume and destination reputation.
2.Isolate the source host and preserve evidence if egress is confirmed.
3.Identify what data the host had access to (data classification / DLP).
4.For DNS tunneling, inspect query entropy and the resolving domain.

Suggested hunting query (KQL)

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where SourceIP == "10.22.7.99"
| summarize Bytes=sum(SentBytes), Conns=count() by DestinationIP, DestinationPort
| order by Bytes desc

ATT&CK candidate shortlist — matched before the model was called, so it justifies from real technique IDs

T1048Exfiltration Over Alternative Protocol·9.5T1041Exfiltration Over C2 Channel·8T1567Exfiltration Over Web Service·7.5T1071Application Layer Protocol·4.5T1005Data from Local System·4.5T1020Automated Exfiltration·4.5T1583.002DNS Server·4.5