Log huntUnit 5 · Topic 5.6
File access log: who is after the data?
Find who is after the data in a file access log.
New to this? Read the topic first: 5.6 Detecting Attacks on Data and Applications.
Simulation · [5.6.A.1, 5.6.A.2]
File access log: who is after the data?
A design firm keeps an access record (accounting) of every file opened, saved, copied or deleted on its project server. Staff work 08:00 to 18:00 from office laptops. customer_cards_backup.xlsx is a honeypot: it looks valuable but holds fake data. Tap every entry that suggests an attack on data. There are 3.
-
Fine. A designer opening a project file during working hours on an office laptop. Normal.
-
Fine. Normal work on a project the user belongs to.
-
Red flag. Someone opened the honeypot. It holds fake data, so there is no legitimate reason to access it: an indicator of malicious activity.
-
Red flag. Outside normal hours, from an unknown device, copying a huge set of files: three signs of data theft at once.
-
Red flag. An attempt to delete sensitive files, right after the mass copy, from the same unknown device.
-
Fine. A common template opened during the day. Normal.
Go to the topic: 5.6 Detecting Attacks on Data and Applications