Connect Tool Use to Exfiltration Risk