FTP/SSH client reads office files

BIOC Low

FTP/SSH client reads office files

Seeing FTP/SSH related software accessing office files could be an indication of data exfiltration.

Module:: Platform Analytics
Agent event type:: File
Category:: Exfiltration
Status:: Enabled

ATT&CK tactics: Exfiltration (TA0010)

ATT&CK techniques: Exfiltration Over Alternative Protocol (T1048)

Indicator:

File file name = *.docx , *.doc , *.xlsx , *.xls , *.ppt , *.pptx AND action type = read Process initiated by = ftp.exe , putty.exe , winscp.exe , plink.exe , bash.exe , scp.exe , pscp.exe , psftp.exe

Preventable: yes