• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Box SaaS Suspicious File Download

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Lacey Cochrane@NullVectorX
    •updated May 23, 2026•5•0•91

    Detects file downloads from Box which could indicate potential data exfiltration by insiders or compromised accounts. This rule specifically looks for 'DOWNLOAD' operations within Box SaaS audit logs.

    Cortex XDR

    Tags

    T1530 - Data from Cloud StorageT1048 - Exfiltration Over Alternative ProtocolT1567 - Exfiltration Over Web ServiceDS0010 - Cloud StorageTA0009 - CollectionTA0010 - ExfiltrationFile DownloadData ExfiltrationCloud Storage AccessSaas ApplicationGeneric Application Log

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?