HighALERT-4210engine: heuristic
Sensitive Data Egress Over HTTPS
analyst review
Raw alert — normalized QRadar offense
- asset
- dc-01-domain-controller
- protocol
- DNS :443
- src_ip
- 10.34.1.246
- dest_ip
- 10.20.2.10
- magnitude
- 7/10
- severity
- 9/10
- credibility
- 5/10
- relevance
- 9/10
- src network
- internal_corp
- events / flows
- 8,617 / 3,558
triggered rules
- ▹ Exfil: Abnormal Outbound Data Volume
- ▹ Exfil: High Entropy DNS Queries
full offense JSON
{
"offense_id": 4210,
"description": "Sensitive Data Egress Over HTTPS :: Data Exfiltration targeting dc-01-domain-controller",
"offense_type": "Source IP",
"offense_source": "10.34.1.246",
"magnitude": 7,
"severity": 9,
"credibility": 5,
"relevance": 9,
"status": "OPEN",
"source_network": "internal_corp",
"destination_networks": [
"internal_corp"
],
"event_count": 8617,
"flow_count": 3558,
"start_time": "2025-11-03T11:23:00+00:00",
"last_updated_time": "2025-11-03T12:11:00+00:00",
"categories": [
"Data Transfer",
"Potential Data Loss/Theft"
],
"rules": [
"Exfil: Abnormal Outbound Data Volume",
"Exfil: High Entropy DNS Queries"
],
"assigned_to": null,
"dest_port": 443
}AI triage
Likely data exfiltration: Sensitive Data Egress Over HTTPS from internal host 10.34.1.246 against dc-01-domain-controller (10.20.2.10) over DNS, 8,617 events observed.
MITRE ATT&CK
T1048Exfiltration Over Alternative ProtocolExfiltrationconfidence 79%
Alert indicators (Sensitive Data Egress Over HTTPS; rules: Exfil: Abnormal Outbound Data Volume) overlap most strongly with T1048 Exfiltration Over Alternative Protocol among the ATT&CK shortlist.
Priority — High
Scored High based on: QRadar magnitude 7/10; high severity (9/10); data exfiltration pattern indicates likely post-compromise activity.
Recommended next steps
- 1.Quantify the outbound volume and destination reputation.
- 2.Isolate the source host and preserve evidence if egress is confirmed.
- 3.Identify what data the host had access to (data classification / DLP).
- 4.For DNS tunneling, inspect query entropy and the resolving domain.
Suggested hunting query (KQL)
CommonSecurityLog | where TimeGenerated > ago(24h) | where SourceIP == "10.34.1.246" | summarize Bytes=sum(SentBytes), Conns=count() by DestinationIP, DestinationPort | order by Bytes desc
ATT&CK candidate shortlist — matched before the model was called, so it justifies from real technique IDs
T1048Exfiltration Over Alternative Protocol·9.5T1041Exfiltration Over C2 Channel·8T1567Exfiltration Over Web Service·7.5T1556.001Domain Controller Authentication·6T1583.002DNS Server·5.5T1207Rogue Domain Controller·5T1071Application Layer Protocol·4.5