Digging deep for data exfiltration