# INC-E9C997 — Bulk finance document collection followed by 1.2 GB egress

**Severity** Medium · **Risk** 58/100 · **Status** resolved

- Opened: 2026-09-03 13:40:29Z
- Last updated: 2026-09-04 19:15:42Z
- Analyst of record: Analyst
- Exported: 2026-09-12 02:40:39Z by Zain Khan

## Summary

hlindqvist read 1,284 documents from the Finance share against a baseline of 14 per day, then transferred 1.2 GB to an external file-transfer service with no prior traffic history.

## Timeline (2 events)

| # | Time (UTC) | Event | Severity | Principal | Host | Source |
|---|---|---|---|---|---|---|
| 1 | 2026-09-03 13:23:29Z | ANOMALOUS_FILE_ACCESS | Medium | hlindqvist | WIN-FS02 | WIN-FS02 |
| 2 | 2026-09-03 13:37:29Z | DATA_EGRESS | Medium | hlindqvist | — | Palo Alto Edge |

### Raw records

1. `2026-09-03 13:23:29Z` Principal hlindqvist read 1,284 documents from \\WIN-FS02\Finance in 9 minutes (baseline: 14/day)
   - Source address: `10.4.12.28`
2. `2026-09-03 13:37:29Z` allow tcp 10.4.12.28:49881 -> 104.28.211.19:443 bytes_out=1284739584 sni="upload.filetransfer.example" — destination unseen in prior 30 days
   - Source address: `10.4.12.28`

## Containment (0)

_No containment actions were executed._

## Case notes (2)

**Analyst** · 2026-09-03 13:55:29Z

Confirmed the engagement with the audit sponsor and matched the destination against the auditor's documented transfer domain. Closing as authorised business activity. Raising a separate hygiene ticket: this transfer should have gone through the sanctioned DLP-inspected channel, and the destination is now baselined so a repeat will not alert.

**Analyst** · 2026-09-03 14:45:29Z

Reached the user directly. hlindqvist is preparing the FY26 audit pack and was asked by Finance leadership to send it to the external auditor, who uses this transfer service.


---

Generated by Aegis Security Operations from stored records. Reference INC-E9C997.