Synopsis
Activation Period |
14 Days |
Training Period |
30 Days |
Test Period |
1 Hour |
Deduplication Period |
1 Day |
Required Data |
|
Detection Modules |
Identity Threat Module |
Detector Tags |
|
ATT&CK Tactic |
|
ATT&CK Technique |
|
Severity |
Informational |
Description
A user downloaded a large volume of files from an organizational SaaS service, either exceeding the normal file count or size for the user's typical behavior.
Attacker's Goals
An attacker may download files from a SaaS service to exfiltrate sensitive data.
Investigative actions
- Check for signs of account compromise, such as abnormal login activity or unusual behavior.
- Review the files that were downloaded to determine if they contain sensitive data.
- Verify if the user account that downloaded the files is authorized to access them.
- Analyze the file types that were downloaded.
- Monitor the account for any further suspicious actions.
Variations
Massive code file downloads from SaaS serviceSuspicious SaaS service file downloads
Massive file downloads from SaaS service by terminated user