File Exploration

A subject may search for or otherwise explore files on a Collaboration Platform (such as SharePoint, OneDrive, Confluence, etc) to identify sensitive or valuable information.

The subject browses, searches, or navigates files stored on a local system to identify data of interest. This includes interaction with files located on endpoint storage such as workstation drives, cached directories, synchronized folders (e.g., cloud sync clients), or application-specific storage locations.

Local file exploration may involve directory traversal, use of operating system search functions, sorting or filtering file views, and opening or previewing files without immediate transfer. In many environments, locally stored data includes synchronized copies of cloud repositories, downloaded attachments, or cached sensitive information, making it a viable source for discovery activity prior to exfiltration.

A subject may search for, or otherwise explore files on a Network Attached Storage (NAS) device to identify sensitive information.

The subject browses, searches, or navigates files stored on removable media to identify data of interest. This includes interaction with external storage devices such as USB flash drives, external hard drives, memory cards, or other mountable media connected to an endpoint.

File exploration on removable media may involve directory traversal, file listing, previewing, or opening files directly from the mounted device. This activity can occur either on media introduced by the subject or on devices previously used for data staging or transfer.