Anthropic-Cybersecurity-Skills/skills/hunting-for-data-exfiltration-indicators/assets/template.md

Data Exfiltration Hunt Template

Hunt Metadata

Field	Value
Hunt ID	TH-EXFIL-YYYY-MM-DD-NNN
Analyst
Date

Hypothesis

[e.g., "Compromised endpoints are exfiltrating sensitive data to cloud storage or via DNS tunneling."]

Findings

#	Source	Destination	Channel	Volume	Period	Risk	Verdict
1

Data Exposure Assessment

Data Type	Volume	Classification	Impact

Recommendations

1. Block: [Destinations to block]
2. DLP: [Rules to deploy]
3. Monitor: [New detection rules]