Bulk File Access: Investigating Context Before Calling It Exfiltration

Technique & Investigation of the Day · Educational, defensive guidance for authorized environments.

Why it matters

A high file-access count can reflect synchronization, migration, indexing or unauthorized collection. Establish what the event actually means before estimating impact. Access, download, sharing and transfer to an external party are different claims requiring different evidence.

Bulk file access: investigation path. Define the dataset; Enrich the actor; Authorized file-access, download and sharing audit events with object and actor identifiers.; Assess impact carefully; Escalate; assess containment impact; Document limits and controls — Original conceptual investigation workflow. No real customer data is shown.

Required telemetry and evidence

Authorized file-access, download and sharing audit events with object and actor identifiers.
Application, session, device and source context where available.
Repository ownership, sensitivity and approved migration or backup records.
Event semantics, deduplication rules, retention and audit coverage.

Before drawing conclusions, record collection scope, retention and any missing fields. Keep sensitive evidence in approved internal systems.

Step-by-step investigation

1. Define the dataset

Specify repositories, identities and the review period. Record whether the source captures reads, downloads, sync activity or some combination. Do not add unlike event counts into an implied number of stolen files.

2. Query the burst

Group by stable identity, application and repository. Retain distinct object identifiers and a sample of original events. Repeated access to one object is different from access to many distinct objects.

3. Enrich the actor

Resolve user versus application context, session and device. Compare with the identity’s role and the intended workflow. A known integration can still be operating outside its approved scope.

4. Test the business explanation

Match a migration, backup or analytics job to timing and objects. Compare peer runs and failures. A broad count threshold cannot replace an owner’s specific explanation.

5. Assess impact carefully

Determine what was accessed and what evidence supports delivery or external sharing. Do not claim exfiltration solely from a download event or a high access count.

6. Document limits and controls

Record the exact event semantics, distinct objects and uncertainty. Review permissions or monitoring gaps with repository owners based on the supported outcome.

Bulk file access: evidence checklist. Authorized file-access, download and sharing audit events with object and actor identifiers.; Application, session, device and source context where available.; Repository ownership, sensitivity and approved migration or backup records.; Event semantics, deduplication rules, retention and audit coverage. — Original conceptual evidence checklist. No real customer data is shown.

Read-only investigation pseudocode

INPUT authorized repository audit export
GROUP events by actor, application, repository and period
COUNT events and distinct object identifiers separately
COMPARE scope with approved jobs and user role
CORRELATE sharing or transfer evidence before making impact claims

Test and adapt: this is illustrative pseudocode, not executable vendor syntax or a tested production detector. Validate field semantics, time boundaries and results in an authorized environment. It does not change systems.

Legitimate activity versus suspicious activity

Client synchronization and document migration can create large bursts. Duplicated or batched audit events can distort counts. An unexplained interactive session accessing unrelated sensitive repositories deserves closer investigation.

Tuning and false positives

Separate service applications, interactive users and migrations. Scope exceptions to exact jobs and repositories with expiry dates. Check distinct objects and sensitivity context instead of relying on total event count alone.

Escalation, containment and documentation

Escalate supported unauthorized access to incident and data owners. Access restriction can interrupt work; use approved authority and preserve evidence. Privacy or notification decisions should use verified scope and the appropriate organizational process.

Close with an evidence-based disposition: explained activity, supported escalation or unresolved visibility gap. Include identifiers, times, source coverage, competing explanations and the response owner.

MITRE ATT&CK context

Data from Cloud Storage (T1530) may be relevant to supported adversarial collection. Do not automatically label collection evidence as an exfiltration technique.

Key takeaways

Define the dataset: define the question before broadening the search.
Assess impact carefully: corroborate the explanation with independent evidence.
Keep the observed facts, assumptions and response decisions separate.

References

Microsoft: audit activity definitions

Original educational workflow and conceptual diagrams for Hack Invasion. Public documentation informs source-specific details; investigation decisions require local validation.