Box Rapid Upload Burst Indicating Staging
Detects a burst of uploads to Box from a single account. Where mass download suggests theft from the platform, a mass upload suggests the platform is being used as the staging point — data collected elsewhere in the estate being moved into cloud storage the attacker controls or can reach from outside. Onboarding: BOX is ingested via Box native connector (Bloo extractor 711). Integration guide: https://bloo.io/docs/hypercloud/box-connector BQL (Bloo Query Language): stream=documents where sourcename='BOX' and action='UPLOADED' | duration 1h | groupby user, srcip | select user, srcip, count(*) as cnt | having cnt > 40
Sigma
