External SaaS file-sharing activity

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	10 Minutes
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: Box Audit Log OR DropBox OR Google Workspace Audit Logs OR Office 365 Audit
Detection Modules	Identity Threat Module
Detector Tags
ATT&CK Tactic	Collection (TA0009)
ATT&CK Technique	Data from Cloud Storage (T1530)
Severity	Informational

A user shared files from within a SaaS service to an external domain.

An attacker may share files from a SaaS service to exfiltrate sensitive data.

Check for signs of account compromise, such as abnormal login activity or unusual behavior.
Determine if the files are shared with users outside the organization and if the recipients are familiar.
Review the files that were shared to determine if they contain sensitive data.
Analyze the file types that were shared.
Monitor the account for any further suspicious actions.

A user shared files to an external domain, which the organization does not typically share files with.

An attacker may share files from a SaaS service to exfiltrate sensitive data.

Check for signs of account compromise, such as abnormal login activity or unusual behavior.
Determine if the files are shared with users outside the organization and if the recipients are familiar.
Review the files that were shared to determine if they contain sensitive data.
Analyze the file types that were shared.
Monitor the account for any further suspicious actions.