Techniques for exfiltration telemetry

One or more non-transitory computer-readable storage media having program instructions stored thereon that, when read and executed by one or more processors of a computing apparatus, direct the computing apparatus to at least:

• generate a tracer payload for a file, wherein:
• the tracer payload comprises an identifier corresponding to the file and embedded content configured to cause a foreign computing environment to automatically perform a telemetry operation when a file access event is performed on a tracer payload-integrated file by the foreign computing environment, wherein the embedded content comprises multiple types of embedded content, and wherein each of the multiple types of embedded content can independently cause the foreign computing environment to automatically perform the telemetry operation,
• the embedded content is configured such that, when the foreign computing environment performs the file access event on the tracer payload-integrated file, one or more of the multiple types of embedded content are automatically processed by native file handling routines of the foreign computing environment,
• to automatically perform the telemetry operation, the one or more of the multiple types of embedded content cause, in response to automatic processing by the native file handling routines, the foreign computing environment to at least automatically generate a network communication from the foreign computing environment to the computing apparatus, and
• the network communication comprises the identifier, host characteristics of the foreign computing environment, and attributes of a network pathway used by the foreign computing environment to transmit the network communication to the computing apparatus;
• integrate the tracer payload into data of the file to produce the tracer payload-integrated file;
• determine, in response to receiving the network communication, that an exfiltration of the file has occurred;
• and
• initiate, in response to determining the exfiltration of the file has occurred, a responsive action.

A computing device comprising:

• one or more computer-readable storage media;
• one or more processors operatively coupled with the one or more computer-readable storage media;
• and
• program instructions stored on the one or more computer-readable storage media that, when read and executed by the one or more processors, direct the computing device to at least:
• generate a tracer payload for a file, wherein:
• the tracer payload comprises an identifier corresponding to the file and embedded content configured to cause a foreign computing environment to automatically perform a telemetry operation when a file access event is performed on a tracer payload-integrated file by the foreign computing environment, wherein the embedded content comprises multiple types of embedded content, and wherein each of the multiple types of embedded content can independently cause the foreign computing environment to automatically perform the telemetry operation;
• the embedded content is configured such that, when the foreign computing environment performs the file access event on the tracer payload-integrated file, one or more of the multiple types of embedded content are automatically processed by native file handling routines of the foreign computing environment;
• to automatically perform the telemetry operation, the one or more of the multiple types of embedded content cause, in response to automatic processing by the native file handling routines, the foreign computing environment to at least automatically generate a network communication from the foreign computing environment to the one or more computing devices;
• and
• the network communication comprises the identifier, host characteristics of the foreign computing environment, and attributes of a network pathway used by the foreign computing environment to transmit the network communication to the one or more computing devices,
• integrate the tracer payload into data of the file to produce the tracer payload-integrated file,
• determine, in response to the network communication, that an exfiltration of the file has occurred, and
• initiate, in response to the exfiltration of the file, a responsive action.