• Application control: Organizations should enforce application controls through Group Policy Objects (GPOs) or other means to prevent the execution of unauthorized applications, including those capable of exfiltrating data.
• Restricting access to abused commercial services: Threat actors frequently exploit commercial services to appear legitimate and blend into the target environment, bypassing reputation-based controls. In most of the incidents ReliaQuest responded to, threat actors used widely available services like MEGA cloud storage and Dropbox for data exfiltration. Organizations should identify the services in use and implement corresponding restrictions, such as categorical restrictions on their proxy or DNS and limitations on RMM software via application control.
• Logging and visibility: Security teams can only act on what they can see within their environment. It is crucial to ensure critical infrastructure, and the broader environment, are forwarding activity logs to a centralized location. This logging and visibility allow security teams to implement correlation-based detection rules, investigate threats, and rapidly respond to and contain incidents resulting from exfiltration tools.
• Use of canary files: Canary files or folders serve as decoys placed within an environment to detect unauthorized operations. These files or folders are presented as valuable and act as traps for threat actors. Implementation of canary files allows security teams to establish rules to detect modifications and respond rapidly, reducing potential damage from an exfiltration attempt.
• Implement data loss prevention (DLP) tools: Organizations should deploy DLP tools to identify, classify, and monitor sensitive data to protect against unauthorized access. DLP tools can integrate with directory services and apply role-based access controls, enabling the creation of custom policies for specific user groups.

Link(s):
https://www.infosecurity-magazine.com/news/rclone-winscp-curl-top-data/