Box Access From New Source Followed by Bulk Download
Detects a Box account accessed from a source address with no prior history, followed by substantial download activity. The combination is far stronger than either signal alone: a new location by itself is routine for mobile users, and downloads by themselves are routine for everyone. Onboarding: BOX is ingested via Box native connector (Bloo extractor 711). Integration guide: https://bloo.io/docs/hypercloud/box-connector BQL (Bloo Query Language): stream=documents where sourcename='BOX' and action='DOWNLOADED' | duration 1h | groupby user, srcip | select user, srcip, count(*) as cnt | having cnt > 25
Sigma
