Canary documents with synthetic sensitive data

exfil_dlp_canary_documents

Writes documents whose content is what data-loss-prevention rules look for — Luhn-valid but unissued test card numbers, national-ID-shaped strings, API-key-shaped strings and a private-key block — and watches whether anything reacts to the content rather than the filename.

Severity medium how bad it would be if it were real

Expected outcome Something should notice

Platforms 3 macOS, Linux, Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

runs in --safe
Observation only. It runs even in the inert mode, because it changes nothing and sends nothing.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1005	Data from Local System	Collection	coverage statistics
T1074.001	Local Data Staging	Collection	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other exfiltration tests

Other tests in the Exfiltration category.
Test	What it does	Severity
Upload to consumer cloud storage exfil_cloud_storage_upload	Attempts to upload a synthetic-PII canary to Dropbox, Google Drive, OneDrive, an anonymous file drop and a paste site, using deliberately invalid cred…	high
DNS tunnelling pattern exfil_dns_tunnel	Issues a burst of long, high-entropy subdomain lookups under a controlled zone — the shape of data being smuggled out inside DNS queries. The data enc…	high
DNS-over-HTTPS resolver bypass exfil_doh_resolution	Resolves a known-bad test domain through public DNS-over-HTTPS resolvers instead of the host's configured resolver, to establish whether DNS filtering…	high
Outbound HTTP POST carrying synthetic PII exfil_http_post_pii	POSTs the synthetic-PII canary to a controlled endpoint over both HTTPS and plain HTTP, so content inspection can be told apart from destination filte…	high

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.