Quick and dirty method do data exfil binary files in the form of hex strings to GCP's cloud logging easily bypassing most DLP

A custom MITRE ATT&CK®-style framework for insider threat detection and investigation — structured as a kill chain, mapped to ATT&CK, with 130+ detection ID mappings.