Box Mass File Download by Single User
Detects a single Box account downloading an unusually high number of distinct files in a short window. This is the clearest signal of data theft from cloud storage, whether by a departing employee or an attacker using a compromised account. Baseline per role before deployment: sales and legal teams legitimately pull large document sets, while most users download a handful of files a day. Onboarding: BOX is ingested via Box native connector (Bloo extractor 711). Integration guide: https://bloo.io/docs/hypercloud/box-connector BQL (Bloo Query Language): stream=documents where sourcename='BOX' and action='DOWNLOADED' | duration 1h | groupby user | select user, distinct_count(file) | having distinct_count_col1 > 50
Sigma
