Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

ChecklistCONSTRUCTEDUntestedMembers

First 15 minutes: a host is uploading gigabytes to cloud storage

A workstation or server is sending far more than usual to a storage or file-sharing service, often out of hours. Measure it before you stop it, because the network record is the only place the volume lives.

high severityExfiltrationT1567.002T1048T1560.001

The clock starts when

Proxy, firewall or EDR telemetry shows a host sending an unusual volume of data to cloud storage or a file-sharing service it does not normally use.

  1. minutes 0 to 5Measure it before you stop it3 lines, 1 where evidence expires
  2. minutes 5 to 10Stop it, keep the tool3 lines
  3. minutes 10 to 15Work out what left3 lines

sources

  1. MITRE ATT&CK T1567.002, Exfiltration Over Web Service: Exfiltration to Cloud Storage · primary
  2. MITRE ATT&CK S1040, Rclone
  3. CISA, MS-ISAC, NSA and FBI: #StopRansomware Guide

Tags: first-15 · exfiltration · rclone · cloud-storage · proxy · data-theft · T1567.002 · T1048