User accessed SaaS resource via anonymous link

Cortex XDR Analytics Alert Reference by Alert name

Product: Cortex XDR
Last date published: 2024-10-08
Category: Analytics Alert Reference
Order: Alert name

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: Google Workspace Audit Logs OR Office 365 Audit
Detection Modules	Identity Threat Module
Detector Tags
ATT&CK Tactic	Collection (TA0009)
ATT&CK Technique	Data from Cloud Storage (T1530)
Severity	Informational

Description

A user accessed a SaaS resource via an anonymous link.

Attacker's Goals

An attacker is attempting to collect sensitive data.

Investigative actions

Check the IP address from which the access originated.
Examine the file that was accessed for any sensitive indicators.
Follow further actions taken, such as downloading files.

Variations

External user accessed a sensitive SaaS file via anonymous link

Synopsis

ATT&CK Tactic	Collection (TA0009)
ATT&CK Technique	Data from Cloud Storage (T1530)
Severity	Low

Description

An external user accessed a sensitive SaaS file via an anonymous link.

Attacker's Goals

An attacker is attempting to collect sensitive data.

Investigative actions

Check the IP address from which the access originated.
Examine the file that was accessed for any sensitive indicators.
Follow further actions taken, such as downloading files.

User accessed a public Google Drive document

Synopsis

ATT&CK Tactic	Collection (TA0009)
ATT&CK Technique	Data from Cloud Storage (T1530)
Severity	Informational

Description

A user accessed a Google Drive document that is public on the web.

Attacker's Goals

An attacker is attempting to collect sensitive data.

Investigative actions

Check the IP address from which the access originated.
Examine the file that was accessed for any sensitive indicators.
Follow further actions taken, such as downloading files.