# Data Exfiltration Hunt Template

## Hunt Metadata
| Field | Value |
|-------|-------|
| Hunt ID | TH-EXFIL-YYYY-MM-DD-NNN |
| Analyst | |
| Date | |

## Hypothesis
> [e.g., "Compromised endpoints are exfiltrating sensitive data to cloud storage or via DNS tunneling."]

## Findings
| # | Source | Destination | Channel | Volume | Period | Risk | Verdict |
|---|--------|-------------|---------|--------|--------|------|---------|
| 1 | | | | | | | |

## Data Exposure Assessment
| Data Type | Volume | Classification | Impact |
|-----------|--------|---------------|--------|
| | | | |

## Recommendations
1. **Block**: [Destinations to block]
2. **DLP**: [Rules to deploy]
3. **Monitor**: [New detection rules]