If your goal is to stop a virus or an active attacker from exfiltrating company data on a PC that can execute arbitrary code on the same client PC, you're hosed.

There's a vast number of sites to dump data to that are the same sites your users ALSO need legitimate access too. You simply can't block these. Unless you're willing to block essentially most of the internet, forget it, you can't do this through blocking.

In the end, the approach of blocking the attacker ONCE HE HAS THE DATA is fruitless. It's like trying to stop an unknown thief who's just stolen the Mona Lisa from leaving the country. There's just way too many ways out, and you don't know what he/she looks like anyway. The really dumb thieves never would have gotten this far anyway.

Instead, you should focus more on limiting access to data in the first place, and deleting information no longer relevant. What's your data retention policy? Attackers can't steal data that's been deleted.

If your goal is to stop a virus or an active attacker from exfiltrating company data stored on a PC that can execute arbitrary code on the same client PC, you're hosed.

There's a vast number of sites to dump data to that are the same sites your users ALSO need legitimate access too. You simply can't block these. Unless you're willing to block essentially most of the internet, forget it, you can't do this through blocking.

In the end, the approach of blocking the attacker ONCE HE HAS THE DATA is fruitless. It's like trying to stop an unknown thief who's just stolen the Mona Lisa from leaving the country. There's just way too many ways out, and you don't know what he/she looks like anyway. The really dumb thieves never would have gotten this far anyway.

Instead, you should focus more on limiting access to data in the first place, and deleting information no longer relevant. What's your data retention policy? Attackers can't steal data that's been deleted.