Detections
- ID: DT009
- Created: 25th May 2024
- Updated: 18th September 2024
- Platforms: Windows, Linux, MacOS
- Contributor: The ITM Team
Cyber Deception, File Canary
By using files with canary tokens as tripwires, investigators can create an early warning system for potential collection activities before a data exfiltration infringement occurs.
By strategically placing these files on endpoints, network shares, FTP servers, and collaboration platforms such as SharePoint or OneDrive, the canaries monitor for access and automatically trigger an alert if an action is detected.
Sections
| ID | Name | Description |
|---|---|---|
| PR004.001 | Network File Exploration | A subject may search for, or otherwise explore files on a Network Attached Storage (NAS) device to identify sensitive information. |
| PR004.002 | Collaboration Platform Exploration | A subject may search for or otherwise explore files on a Collaboration Platform (such as SharePoint, OneDrive, Confluence, etc) to identify sensitive or valuable information. |
| PR006.003 | Security Enumeration via File System | A subject attempts to identify security software on a target system by looking through the file system to identify relevant directories or files. |