topic Re: BIOC Rules for OneDrive File Uploads | Exfiltration in Cortex XDR Discussions

BIOC Rules for OneDrive File Uploads | Exfiltration

Melvin_Machado — Fri, 27 Sep 2024 14:51:54 GMT

Hello,

I have encountered an issue where some users in my organization are uploading large files (around 100 GB) to their personal OneDrive accounts using public Microsoft domains. Currently, Cortex is allowing these actions without signaling them.

To address this, I created my own BIOC rules, which are functioning well :

preset = network_story
| filter dst_action_external_hostname in ("*.onedrive.com", "*.onedrive.live.com") and action_total_upload > 1000000

However, I'm facing two challenges:

Multiple alerts are being generated, but no Incident (INC) is being created.
How can I consolidate these alerts to generate only one alert (instead of 20) when a user uploads files to OneDrive?

I would appreciate your guidance on resolving these issues.

Thank you!

Re: BIOC Rules for OneDrive File Uploads | Exfiltration

jmazzeo — Mon, 30 Sep 2024 14:45:22 GMT

Hi @Melvin_Machado, thanks for reaching us using the Live Community.

What is the severity configured to this custom BIOC rule? Only Medium to Critical alerts will generate an Incident, and if the host generating it is always the same, the alerts should be added to the same Incident.

If this post answers your question, please mark it as the solution.

Re: BIOC Rules for OneDrive File Uploads | Exfiltration

Melvin_Machado — Tue, 01 Oct 2024 08:36:26 GMT

Hello Jmazzeo,

When I change the severity to Medium, it creates an incident and merges all the alerts as expected 🙂

However, I’m facing another issue now. An alert is being generated even when only 4 KB is uploaded.

I would like the system to trigger an alert only when more than 10 MB is uploaded. Could you help me adjust this setting?

Thank you!

Re: BIOC Rules for OneDrive File Uploads | Exfiltration

Melvin_Machado — Fri, 18 Oct 2024 14:31:42 GMT

Thank you for your help! I found a solution.

preset = network_story
| filter dst_action_external_hostname in ("*.onedrive.com", "*.onedrive.live.com")
| filter action_total_upload > 10485760

Re: BIOC Rules for OneDrive File Uploads | Exfiltration

Melvin_Machado — Fri, 29 Nov 2024 15:25:12 GMT

| filter action_total_upload > 80000000 // bit (10 Mo)