Correlation Rule High
✕

DropBox - Massive File Alterations

This rule detects more than 100 edited files during an hour by the same user. This is a suspicious behavior which can be an indication of a ransomware attack.

Module:
Platform Analytics
Data source:
dropbox_dropbox_raw
Category:
Other
Content pack:
Dropbox
ATT&CK tactics: Impact (TA0040)
ATT&CK techniques: Data Encrypted for Impact (T1486)
Execution:
SCHEDULED
Search window:
4 hours
XQL query: 
datamodel dataset = dropbox_dropbox_raw
| filter xdm.event.type = "file_operations" and xdm.event.operation_sub_type = "file_edit"
| alter user = coalesce(xdm.source.user.username, xdm.target.user.username)
| comp values(xdm.source.ipv4) as SourceIP, values(xdm.source.location.country) as Countries, max(_time) as lastTime, values(xdm.target.resource.name) as Files, count() as NumberOfFiles by user
| filter NumberOfFiles > 100

Open the full correlation rule →