Skip to content

Commit b0dfcb1

Browse files
aring87aring87
committed
Adding new triage guides
1 parent 52cf8d5 commit b0dfcb1

4 files changed

Lines changed: 379 additions & 0 deletions

File tree

‎content/triage-guides/sentinel/collection/Data-Collection-from-Local-System.md‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
# Triage Guide: Data Collection from Local System
2+
3+
## Detection Title
4+
Data Collection from Local System
5+
6+
## Detection ID
7+
dodea-sig-018-data-collection-from-local-system
8+
9+
## Objective
10+
11+
This detection identifies access to user data locations and common document types on the local system. It is intended to surface behavior that may indicate collection of sensitive files for staging, review, or later exfiltration.
12+
13+
## Why It Matters
14+
15+
Attackers commonly collect data from local systems before exfiltration. Targeted file types such as:
16+
- `.docx`
17+
- `.pdf`
18+
- `.xls`
19+
- `.csv`
20+
21+
may indicate interest in business documents, reports, exports, or user-generated content.
22+
23+
This detection is most meaningful when tied to suspicious process context or follow-on staging behavior.
24+
25+
## Alert Logic Summary
26+
27+
The rule looks for file activity in paths such as:
28+
- `C:\Users\`
29+
- `Desktop`
30+
- `Documents`
31+
32+
and file types such as:
33+
- `.docx`
34+
- `.pdf`
35+
- `.xls`
36+
- `.csv`
37+
38+
## Initial Triage Questions
39+
40+
- Which process accessed the files?
41+
- Which user context was involved?
42+
- Was the file access normal for the user’s role?
43+
- Was this isolated file access or part of a broader pattern?
44+
- Were files later compressed, copied, or transferred?
45+
46+
## Investigation Steps
47+
48+
1. Review the affected device and user context.
49+
2. Review the file names, folders, and action types involved.
50+
3. Identify the initiating process if available in related telemetry.
51+
4. Determine whether the file access pattern aligns with:
52+
- user productivity
53+
- backup/indexing
54+
- document search
55+
- suspicious staging behavior
56+
5. Check for related behavior:
57+
- archive creation
58+
- cloud upload
59+
- outbound network transfer
60+
- removable media access
61+
6. Review whether the same process touched many files or multiple folders.
62+
63+
## Common False Positives
64+
65+
- legitimate user access to personal or work documents
66+
- indexing and search services
67+
- backup tools
68+
- anti-malware scanning
69+
- DLP or compliance tooling
70+
- file preview behavior in normal workflows
71+
72+
## Escalation Guidance
73+
74+
Escalate when:
75+
- a suspicious process accesses many document files
76+
- file access is followed by compression or outbound transfer
77+
- the user or host context is unusual
78+
- access occurs during off-hours or from suspicious sessions
79+
- the file access pattern is inconsistent with the user’s role
80+
81+
## Recommended Enrichment
82+
83+
- file access timeline
84+
- associated process telemetry
85+
- archive creation telemetry
86+
- outbound network activity
87+
- removable media usage
88+
- cloud application events
89+
- user role and host criticality
90+
91+
## ATT&CK Mapping
92+
93+
- Collection
94+
- T1005 – Data from Local System
95+
96+
## Related Rule
97+
98+
- `detections/sentinel/collection/data-collection-from-local-system.yml`

‎content/triage-guides/sentinel/collection/clipboard-data-collection.md‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
# Triage Guide: Clipboard Data Collection
2+
3+
## Detection Title
4+
Clipboard Data Collection
5+
6+
## Detection ID
7+
SENT-COLL-0001
8+
9+
## Objective
10+
11+
This detection identifies command-line or PowerShell activity interacting with clipboard contents. This may indicate collection of copied data, credentials, tokens, or user-generated content from the local system.
12+
13+
## Why It Matters
14+
15+
Attackers may access clipboard data to capture:
16+
- copied passwords
17+
- MFA codes
18+
- wallet addresses
19+
- sensitive text copied from documents or portals
20+
- other user data staged in memory for quick access
21+
22+
Clipboard access alone is not inherently malicious, but it becomes more concerning when combined with credential access, scripting, or outbound transfer behavior.
23+
24+
## Alert Logic Summary
25+
26+
The rule looks for:
27+
- `powershell.exe`
28+
- `pwsh.exe`
29+
- `cmd.exe`
30+
31+
with command lines containing:
32+
- `Get-Clipboard`
33+
- `Set-Clipboard`
34+
- `clip.exe`
35+
36+
## Initial Triage Questions
37+
38+
- Who ran the command?
39+
- Was the user performing legitimate admin or scripting work?
40+
- Was the command interactive, scripted, or part of automation?
41+
- Did the same session show signs of credential access, staging, or exfiltration?
42+
- Is the host a normal workstation, admin jump box, or shared support system?
43+
44+
## Investigation Steps
45+
46+
1. Review the full process command line.
47+
2. Confirm the executing user and logon context.
48+
3. Identify the parent process.
49+
4. Determine whether the activity was initiated from:
50+
- an interactive terminal
51+
- a script
52+
- a remote session
53+
- an automation tool
54+
5. Check for related activity shortly before or after:
55+
- archive creation
56+
- file enumeration
57+
- browser credential access
58+
- outbound network connections
59+
6. Review whether the clipboard command was reading, overwriting, or piping data.
60+
61+
## Common False Positives
62+
63+
- benign PowerShell automation
64+
- help desk or support workflows
65+
- user productivity scripts
66+
- clipboard cleanup or formatting utilities
67+
- scripts that copy command output for administrative purposes
68+
69+
## Escalation Guidance
70+
71+
Escalate when:
72+
- clipboard access is paired with suspicious scripting or encoded commands
73+
- the affected user is privileged or high-value
74+
- clipboard access occurs near exfiltration, archiving, or credential-theft behavior
75+
- the parent process or execution context is suspicious
76+
- the user cannot explain the activity
77+
78+
## Recommended Enrichment
79+
80+
- process tree
81+
- user logon session context
82+
- parent and child processes
83+
- recent file access activity
84+
- recent network connections
85+
- related alerts on the same host
86+
- account privilege level
87+
88+
## ATT&CK Mapping
89+
90+
- Collection
91+
- T1115 – Clipboard Data
92+
93+
## Related Rule
94+
95+
- `detections/sentinel/collection/clipboard-data-collection.yml`

‎content/triage-guides/sentinel/collection/mass-file-enumeration-in-user-data-paths.md‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
# Triage Guide: Mass File Enumeration in User Data Paths
2+
3+
## Detection Title
4+
Mass File Enumeration in User Data Paths
5+
6+
## Detection ID
7+
SENT-COLL-0002
8+
9+
## Objective
10+
11+
This detection identifies processes touching large numbers of files across user data paths within a short period. This may indicate data discovery, staging, or collection activity prior to archiving or exfiltration.
12+
13+
## Why It Matters
14+
15+
Large-scale file enumeration across:
16+
- user profiles
17+
- desktop folders
18+
- document folders
19+
- download directories
20+
21+
can indicate an attempt to identify or collect valuable user data. While some legitimate tools do this, the behavior is important to review when tied to suspicious processes or timing.
22+
23+
## Alert Logic Summary
24+
25+
The rule looks for activity in paths such as:
26+
- `\Users\`
27+
- `\Desktop\`
28+
- `\Documents\`
29+
- `\Downloads\`
30+
31+
It summarizes file touches over 15 minutes and alerts when:
32+
- file touches are high
33+
- multiple distinct user-data paths are involved
34+
35+
## Initial Triage Questions
36+
37+
- What process touched the files?
38+
- Is the process a known backup, indexing, or security tool?
39+
- Was the user performing normal file-management activity?
40+
- Did the process also create archives or stage files?
41+
- Is there outbound transfer behavior soon after?
42+
43+
## Investigation Steps
44+
45+
1. Identify the initiating process and account.
46+
2. Review the time window and total file-touch volume.
47+
3. Confirm whether the process is expected on the host.
48+
4. Determine whether the activity is:
49+
- backup
50+
- search indexing
51+
- anti-malware scanning
52+
- scripted file collection
53+
5. Review for related activity after enumeration:
54+
- zip or archive creation
55+
- cloud upload
56+
- external network transfer
57+
- copying to temporary or staging locations
58+
6. Check whether the same process touched sensitive departments, shared data, or multiple users’ folders.
59+
60+
## Common False Positives
61+
62+
- backup agents
63+
- indexing services
64+
- anti-malware or EDR scanning
65+
- administrative bulk file operations
66+
- migration or profile-copy utilities
67+
68+
## Escalation Guidance
69+
70+
Escalate when:
71+
- the process is unusual or unsigned
72+
- enumeration is followed by compression or transfer
73+
- the user context is suspicious
74+
- the process is script-based or attacker-adjacent
75+
- the host shows related discovery, collection, or exfiltration behavior
76+
77+
## Recommended Enrichment
78+
79+
- initiating process details
80+
- signer and file path of the process
81+
- parent process
82+
- archive creation events
83+
- outbound network telemetry
84+
- cloud application activity
85+
- recent alerts on the same host
86+
87+
## ATT&CK Mapping
88+
89+
- Collection
90+
- T1005 – Data from Local System
91+
- T1039 – Data from Network Shared Drive
92+
93+
## Related Rule
94+
95+
- `detections/sentinel/collection/mass-file-enumeration-in-user-data-paths.yml`

‎content/triage-guides/sentinel/collection/screen-capture-utility-execution.md‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
# Triage Guide: Screen Capture Utility Execution
2+
3+
## Detection Title
4+
Screen Capture Utility Execution
5+
6+
## Detection ID
7+
SENT-COLL-0003
8+
9+
## Objective
10+
11+
This detection identifies execution of screenshot or screen-capture tools that may be used to collect visible user-session data, application contents, or on-screen credentials.
12+
13+
## Why It Matters
14+
15+
Screen capture can be used to collect:
16+
- user session details
17+
- visible documents
18+
- internal dashboards
19+
- chat contents
20+
- credentials or MFA prompts displayed on screen
21+
22+
This behavior is not always malicious, but it becomes more significant when tied to remote access, credential theft, or exfiltration activity.
23+
24+
## Alert Logic Summary
25+
26+
The rule looks for execution of:
27+
- `snippingtool.exe`
28+
- `psr.exe`
29+
- `nircmd.exe`
30+
31+
or command lines containing:
32+
- `screenshot`
33+
- `capturedesktop`
34+
- `screen capture`
35+
36+
## Initial Triage Questions
37+
38+
- Was the host being used for support or documentation?
39+
- Is the user known to take screenshots as part of their role?
40+
- Was the tool launched interactively or by script?
41+
- Were image files written to disk?
42+
- Was there follow-on staging or exfiltration behavior?
43+
44+
## Investigation Steps
45+
46+
1. Review the executing process and command line.
47+
2. Identify the user and session context.
48+
3. Determine whether the host was under support, training, or documentation activity.
49+
4. Review whether image or capture files were created and where.
50+
5. Check for related suspicious activity:
51+
- remote access tools
52+
- credential access
53+
- archive creation
54+
- outbound transfer
55+
6. Determine whether the tool is approved and expected in the environment.
56+
57+
## Common False Positives
58+
59+
- legitimate screenshots by users
60+
- IT support sessions
61+
- training or documentation creation
62+
- problem-step recording for troubleshooting
63+
- approved admin or automation tooling
64+
65+
## Escalation Guidance
66+
67+
Escalate when:
68+
- capture tools are launched by unusual parent processes
69+
- capture activity is scripted or hidden
70+
- images are staged for outbound transfer
71+
- the affected host or account is high-value
72+
- the activity is paired with credential access or remote-control behavior
73+
74+
## Recommended Enrichment
75+
76+
- process tree
77+
- written image or recording files
78+
- destination folders
79+
- recent outbound network activity
80+
- remote access tool presence
81+
- related alerts on the same host
82+
- user role and host sensitivity
83+
84+
## ATT&CK Mapping
85+
86+
- Collection
87+
- T1113 – Screen Capture
88+
89+
## Related Rule
90+
91+
- `detections/sentinel/collection/screen-capture-utility-execution.yml`

0 commit comments

Comments
 (0)