A user performed suspiciously massive file activity

Cortex XDR Analytics Alert Reference by data source

Product

Cortex XDR

Last date published

2024-12-03

Activation Period	14 Days
Training Period	30 Days
Test Period	1 Hour
Deduplication Period	1 Day
Required Data	Requires: XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules	Identity Threat Module
Detector Tags
ATT&CK Tactic	Collection (TA0009)
ATT&CK Technique	Automated Collection (T1119) Data Staged: Local Data Staging (T1074.001) Data Staged: Remote Data Staging (T1074.002)
Severity	Informational

A user generated massive file activity by size or distinct file count.

Collect data and stage it on an endpoint in the organization.

Check whether the process that created the massive file activity creates network connections as well.
Check which files the process performed the activity on.
Check whether other users in the organization used the same process for file activity.

ATT&CK Tactic

ATT&CK Technique

Severity

Low

A user generated massive file activity by size or distinct file count.

Collect data and stage it on an endpoint in the organization.

Check whether the process that created the massive file activity creates network connections as well.
Check which files the process performed the activity on.
Check whether other users in the organization used the same process for file activity.