Correlation Rule Medium
✕

DropBox - Massive File Downloads

This rule detects more than 100 downloaded files during an hour by the same user. This is a suspicious behavior which can be an indication of a data exfiltration.

Module:
Platform Analytics
Data source:
dropbox_dropbox_raw
Category:
Exfiltration
Content pack:
Dropbox
ATT&CK tactics: Exfiltration (TA0010)
ATT&CK techniques: Exfiltration Over Web Service (T1567)
Execution:
SCHEDULED
Search window:
4 hours
XQL query: 
datamodel dataset = dropbox_dropbox_raw
| filter xdm.event.type = "file_operations" and xdm.event.operation_sub_type = "file_download"
| alter user = coalesce(xdm.source.user.username, xdm.target.user.username)
| comp values(xdm.source.ipv4) as SourceIP, values(xdm.source.location.country) as Countries, max(_time) as lastTime, values(xdm.target.resource.name) as Files, count() as NumberOfFiles by user
| filter NumberOfFiles > 100

Open the full correlation rule →