Analytics BIOC
Informational
✕
An Azure SQL database was exported from a production subscription
An Azure SQL database export was initiated. The database was exported from a production subscription.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- Azure Audit Log
ATT&CK tactics: Exfiltration (TA0010)
ATT&CK techniques: Transfer Data to Cloud Account (T1537)
Detector tags: Data Detection & Response Cloud Data Asset Exfiltration
Attacker's goals:
Exfiltrate data to an unknown bucket.
Investigative actions:
Check the legitimacy of the referenced destination bucket. Review further logs for the source SQL instance. Review further actions performed by the identity.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day