Aegis
Rule library
// Detection

Mass file access

One principal reading far more files in a short window than normal use produces, consistent with staging data for collection.

HighInvestigating1alerts raisedThreshold
Armed

What this rule does

Rendered from the stored logic, so it cannot drift from what executes.

20+ events where eventType is one of FILE_READ, ANOMALOUS_FILE_ACCESS, grouped by username, within 10 minutes

{
  "kind": "threshold",
  "count": 20,
  "where": [
    {
      "op": "in",
      "field": "eventType",
      "value": [
        "FILE_READ",
        "ANOMALOUS_FILE_ACCESS"
      ]
    }
  ],
  "groupBy": "username",
  "windowMinutes": 10
}

Revise

Backtest before saving. Alerts already raised keep their original descriptions: they record what the rule found at the time.

Fields: eventType, username, sourceIp, destinationIp, hostname, processName, commandLine, parentProcess, action, status, country, city

Alerts raised (1)

What this rule has actually caught.

AlertFindingStatusRiskRaised
ALT-655369hlindqvist read 1,284 documents in nine minutes against a baseline of fourteen per day.Resolved52

Rule

Category
Collection
ATT&CK tactic
Collection
Technique
T1005
Kind
Threshold
State
Armed
Created
2mo ago
Last changed
2mo ago

Firing history

Total alerts
1
First fired
2mo ago
Last fired
2mo ago
Escalated to cases
1
Dismissed benign
0

Related