DocsAttack Types

Data Exfiltration & Suspicious Transfers

Unusual outbound transfers for this VM.

A VM sends unusually large amounts of data out, which can mean stolen data leaving a compromised machine. Backups and legitimate uploads look similar, so by default Frabs alerts your team rather than acting.

Detectors (6)

Detector	Measures	Warning	Incident	Critical
DNS Exfiltration	Tunnelling indicators (0-100) (score)	50 in 10 min	70 in 30 min	90 in 1 h
Large Outbound Transfer	Bytes sent to external destinations (bytes)	1,000,000,000 in 1 h	10,000,000,000 in 1 h	50,000,000,000 in 1 h
High-Volume External Upload	Bytes sent to external destinations (bytes)	1,000,000,000 in 1 h	10,000,000,000 in 1 h	50,000,000,000 in 1 h
Suspicious External Destination	Contacts with addresses on threat-intelligence lists (contacts)	1 in 10 min	10 in 1 h	100 in 1 h
Known Exfiltration Destination	Contacts with addresses on threat-intelligence lists (contacts)	1 in 10 min	10 in 1 h	100 in 1 h
Encrypted Tunnel Activity	Tunnelling indicators (0-100) (score)	50 in 10 min	70 in 30 min	90 in 1 h

Change the thresholds

Use Custom Protection to change any of these, or set them for one VM. See Detectors and Thresholds.

PreviousCryptomining NextNetwork Tunnelling & Covert Traffic