External SaaS file-sharing activity

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	10 Minutes
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: Box Audit Log OR DropBox OR Google Workspace Audit Logs OR Office 365 Audit
Detection Modules	Identity Threat Module, SaaS Threat Detection
Detector Tags	Data Detection & Response
ATT&CK Tactic	Collection (TA0009)
ATT&CK Technique	Data from Cloud Storage (T1530)
Severity	Informational

Description

A user shared files from within a SaaS service to an external domain.

Attacker's Goals

An attacker may share files from a SaaS service to exfiltrate sensitive data.

Investigative actions

• Check for signs of account compromise, such as abnormal login activity or unusual behavior.
• Determine if the files are shared with users outside the organization and if the recipients are familiar.
• Review the files that were shared to determine if they contain sensitive data.
• Analyze the file types that were shared.
• Monitor the account for any further suspicious actions.

Variations

SaaS external file sharing to an abnormal domain

Synopsis

Field	Value
ATT&CK Tactic	Collection (TA0009)
ATT&CK Technique	Data from Cloud Storage (T1530)
Severity	Low

Description

A user shared files to an external domain, which the organization does not typically share files with.

Attacker's Goals

An attacker may share files from a SaaS service to exfiltrate sensitive data.

Investigative actions

• Check for signs of account compromise, such as abnormal login activity or unusual behavior.
• Determine if the files are shared with users outside the organization and if the recipients are familiar.
• Review the files that were shared to determine if they contain sensitive data.
• Analyze the file types that were shared.
• Monitor the account for any further suspicious actions.