Threat Hunting Exercise: Analyzing Proxy Personal Cloud Storage Exfiltration Dataset
This hunt uses a simulated web proxy dataset (proxy_personal_cloud_exfil_2022-05-07T140000.json) capturing T1567.002: Exfiltration to Cloud Storage, where an insider or compromised account uploads sensitive files to a personal (non-corporate-tenant) cloud storage account shortly before a resignation date, disguised within normally-allowed SaaS traffic.
Step 1: Hypothesis Formation
Hypothesis: A user account uploads an unusually large volume of data to a personal instance of an approved cloud storage service (e.g., a personal Google Drive/Dropbox account rather than the corporate tenant) in a short window, distinguishable via tenant-ID or account-ID fields in proxy/CASB logs, with the activity clustering just before a known employment separation date. Indicators:
- Proxy/CASB logs: upload (PUT/POST) volume to .dropbox.com or .google.com far exceeding the user's 30-day baseline.
- Tenant/account identifier in the SaaS API log does not match the corporate tenant ID.
- HR record shows a resignation or termination date within 14 days of the activity.
- Files involved match sensitive naming patterns (e.g., "Client_List", "Pricing", "Source_Code") pulled from a preceding mass file-read event.
Null Hypothesis: The user is uploading personal files (e.g., photos, personal documents) unrelated to corporate data, a common and generally low-risk use of allowed personal cloud services. Invalidate by correlating upload timing/volume with a preceding mass file-access event on corporate file shares.
Rationale: CASB/proxy tenant-isolation controls are frequently misconfigured or absent, making personal-instance access to sanctioned SaaS categories a persistent blind spot; this hunt validates detection using tenant-ID enrichment combined with HR context, a classic insider-risk hunting pattern.
Step 2: Data Sources and Scope
- Sources: Web proxy/CASB logs with tenant-ID visibility; File server access logs (Windows Security 4663) for preceding read activity; HR system export (separation dates, access-controlled).
- Scope: ~2022-05-07T14:00:00-18:00:00 UTC; User: j.martinez (10.70.9.31); Destination: personal Dropbox tenant (non-corporate account ID).
- SIEM Queries (Splunk/ELK):
- Tenant mismatch upload:
index=casb app="dropbox" action=upload tenant_id!="corp-tenant-9182" | stats sum(bytes) as total_upload by user - Baseline comparison:
index=casb app="dropbox" user="j.martinez" earliest=-30d | stats avg(daily_bytes) as baseline - Preceding file access:
index=winsecurity EventID=4663 AccountName="j.martinez" ObjectName="ClientList" OR ObjectName="Pricing"
Step 3: Key Findings
Parsed events (7 shown) confirm 2.3 GB uploaded to a personal Dropbox tenant, roughly 40x the user's 30-day baseline, preceded by mass file reads matching sensitive naming patterns.
| Timestamp (UTC) | User | Action | Destination | IOC/Why Suspicious? |
|---|---|---|---|---|
| 2022-05-07 13:40:02 | j.martinez | 4663 Read | \\FILESRV\Sales\ClientList_2022_Master.xlsx | Precursor IOC: sensitive client-list file accessed 20 minutes before the upload burst begins. |
| 2022-05-07 13:44:19 | j.martinez | 4663 Read | \\FILESRV\Sales\Pricing_Strategy_Confidential.pptx | Second sensitive file read in the same short window - pattern of targeted collection, not routine work. |
| 2022-05-07 14:02:33 | j.martinez | Dropbox upload | tenant_id=personal-88213 (non-corp) | Tenant IOC: upload destined for a personal Dropbox account, not the corporate-managed tenant (corp-tenant-9182) - CASB policy assumes corporate tenant only, creating a blind spot. |
| 2022-05-07 14:05-14:40 | j.martinez | Dropbox upload x14 | tenant_id=personal-88213 | 14 sequential uploads totaling 2.3 GB - file sizes and count consistent with the two sensitive documents plus surrounding folder contents. |
| - | j.martinez | (30-day baseline) | N/A | Volume IOC: baseline average daily Dropbox usage for this user is ~55 MB; this single session is ~42x that baseline. |
| - | j.martinez | (HR record) | N/A | Context IOC: HR export shows a resignation submitted 2022-05-03, with last day of employment 2022-05-20 - activity falls within the classic pre-departure exfiltration window. |
| 2022-05-07 18:00:00 | j.martinez | (session end) | N/A | No further Dropbox activity after 14:40 - consistent with a single deliberate collection-and-exfil session rather than ongoing personal use. |
Validation:
- Timeline: Sensitive file reads immediately preceding a large personal-cloud upload burst, within a known pre-resignation window - a strong composite indicator.
- False Positives: Ruled out routine personal use via the 42x baseline deviation and the direct correlation to sensitive file-read events immediately prior.
- Correlation: Single user, single session, tight temporal linkage between file access and upload - high-confidence insider-risk case, not broad SaaS noise.
Step 4: Recommendations & Next Steps
- Immediate Response: Engage HR/Legal per insider-threat playbook before any user-facing action; suspend the user's remote access and cloud-service permissions pending investigation; preserve the uploaded content list via Dropbox API audit log (do not attempt direct access without legal counsel); revoke corporate device access ahead of the departure date if policy allows.
- Detection: Sigma-style CASB rule:
title: Personal-Tenant Upload Following Sensitive File Access→selection1: winsecurity EventID=4663 ObjectName matches sensitive_pattern | selection2 (within 30 min): casb upload tenant_id != corp_tenant AND bytes > 20x baseline- chain HR separation feed as a risk-scoring multiplier. - Pro Tip: CASB tenant-ID enrichment is essential - without it, personal and corporate instances of the same SaaS app are indistinguishable in proxy logs, and this entire class of insider exfiltration goes undetected; prioritize enabling tenant restrictions (e.g., Google/Microsoft tenant-restriction headers) as a preventive control alongside detection.
Hypothesis confirmed - targeted collection of sensitive files followed by large-volume upload to a personal (non-corporate) cloud storage tenant, within a pre-resignation window!