Microsoft Sentinel high experimental kql

Digital Guardian - Exfiltration to online fileshare

'Detects exfiltration to online fileshare.'

View Source

Detection Logic

let threshold = 10;
DigitalGuardianDLPEvent
| where isnotempty(inspected_document)
| where http_url contains 'dropbox' or http_url contains 'mega.nz'
| summarize f = dcount(inspected_document) by SrcUserName, bin(TimeGenerated, 30m)
| where f >= threshold
| extend AccountCustomEntity = SrcUserName

Field Validations

Loading…

Comments (0)

Loading comments...