Application-based file exfiltration detection
Disclosed in some examples are methods, systems, and machine readable mediums for applications that detect indicators of data exfiltration through applications such as browser-based interfaces. The disclosed system monitors file system element events related to one or more target applications (such as browsers) through operating system interfaces. Once an event of interest is detected, the system interfaces with the browser to determine a context for the event of interest that may include a URL of a website that the user was visiting corresponding to the file system element event. If the URL is directed towards a prohibited site, a notification may be generated that may be used as a signal to alert an administrator. As used herein, a file system element may include a file, directory, folder, archive, blob, raw storage, metadata, or the like. File system element events may include copying, deleting, modifying, or moving a file system element. A file system element event may be detected by monitoring Input/Output requests of a computing device to write to a file; move a file; delete a file; or the like.
1. A method for detecting file exfiltration, the method comprising:
using one or more processors, executing an application, the application performing operations comprising:
identifying a file system element event corresponding to a file system element via an operating system;
determining that the file system element event corresponds to a web-browser application, the web-browser application a separate application from the application;
responsive to determining that the file system element event corresponds to the web-browser application:
determining a website visited by the web-browser application corresponding to the file system element event;
identifying that the website visited by the web-browser application is a network-based file storage or sharing service;
identifying an account used to access the network-based file storage or sharing service;
determining that the account used to access the network-based file storage or sharing service is not an account of an organization associated with the file system element;
determining to send an alert to an administrative computing device based upon the identifying that the website visited by the web-browser application is the network-based file storage or sharing service and based upon determining that the account used to access the network-based file storage or sharing service is a personal account; and
responsive to determining that an alert is to be sent, sending the alert to the administrative computing device, the alert indicating that the file system element event that is characteristic of an unauthorized file exfiltration has been detected.
2. The method of claim 1 , wherein identifying the file system element event comprises utilizing a minifilter in a filter manager of a file system in a kernel mode.
3. The method of claim 1 , wherein identifying the file system element event comprises reading an event stream of file system element events provided by the operating system.
4. The method of claim 3 , wherein the event stream is provided by a Basic Security Module or an Endpoint Security Framework.
5. The method of claim 1 , wherein determining the website visited by the web-browser application corresponding to the file system element event comprises reading a database kept by the web-browser application storing a browsing history.
6. The method of claim 1 , wherein determining the website visited by the web-browser application corresponding to the file system element event comprises utilizing a scripting bridge.
7. The method of claim 1 , wherein identifying the account used to access the network-based file storage or sharing service comprises using screen scraping to identify the account.
8. A computing device for detecting file exfiltration, the device comprising:
one or more processors;
a memory, storing instructions, which when executed by the one or more processors, cause the one or more processors to perform operations of an application, the operations of the application comprising:
identifying a file system element event corresponding to a file system element via an operating system;
determining that the file system element event corresponds to a web-browser application, the web-browser application a separate application from the application;
responsive to determining that the file system element event corresponds to the web-browser application:
determining a website visited by the web-browser application corresponding to the file system element event;
identifying that the website visited by the web-browser application is a network-based file storage or sharing service;
identifying an account used to access the network-based file storage or sharing service;
determining that the account used to access the network-based file storage or sharing service is not an account of an organization associated with the file system element;
determining to send an alert to an administrative computing device based upon the identifying that the website visited by the web-browser application is the network-based file storage or sharing service and based upon determining that the account used to access the network-based file storage or sharing service is a personal account; and
responsive to determining that an alert is to be sent, sending the alert to the administrative computing device, the alert indicating that the file system element event that is characteristic of an unauthorized file exfiltration has been detected.
9. The computing device of claim 8 , wherein identifying the file system element event comprises utilizing a minifilter in a filter manager of a file system in a kernel mode.
10. The computing device of claim 8 , wherein identifying the file system element event comprises reading an event stream of file system element events provided by the operating system.
11. The computing device of claim 10 , wherein the event stream is provided by a Basic Security Module or an Endpoint Security Framework.
12. The computing device of claim 8 , wherein determining the website visited by the web-browser application corresponding to the file system element event comprises reading a database kept by the web-browser application storing a browsing history.
13. The computing device of claim 8 , wherein determining the website visited by the web-browser application corresponding to the file system element event comprises utilizing a scripting bridge.
14. The computing device of claim 8 , wherein identifying the account used to access the network-based file storage or sharing service comprises using screen scraping to identify the account.
15. A non-transitory machine-readable medium, storing instructions for detecting file exfiltration, the instructions, which when executed by a computing device, causes the computing device to perform operations comprising:
identifying a file system element event corresponding to a file system element via an operating system;
determining that the file system element event corresponds to a web-browser application, the web-browser application a separate application from the application;
responsive to determining that the file system element event corresponds to the web-browser application:
determining a website visited by the web-browser application corresponding to the file system element event;
identifying that the website visited by the web-browser application is a network-based file storage or sharing service;
identifying an account used to access the network-based file storage or sharing service;
determining that the account used to access the network-based file storage or sharing service is not an account of an organization associated with the file system element;
determining to send an alert to an administrative computing device based upon the identifying that the website visited by the web-browser application is the network-based file storage or sharing service and based upon determining that the account used to access the network-based file storage or sharing service is a personal account; and
responsive to determining that an alert is to be sent, sending the alert to the administrative computing device, the alert indicating that the file system element event that is characteristic of an unauthorized file exfiltration has been detected.
16. The non-transitory machine-readable medium of claim 15 , wherein identifying the file system element event comprises utilizing a minifilter in a filter manager of a file system in a kernel mode.
17. The non-transitory machine-readable medium of claim 15 , wherein identifying the file system element event comprises reading an event stream of file system element events provided by the operating system.
18. The non-transitory machine-readable medium of claim 17 , wherein the event stream is provided by a Basic Security Module or an Endpoint Security Framework.
19. The non-transitory machine-readable medium of claim 15 , wherein determining the website visited by the web-browser application corresponding to the file system element event comprises reading a database kept by the web-browser application storing a browsing history.
20. The non-transitory machine-readable medium of claim 15 , wherein determining the website visited by the web-browser application corresponding to the file system element event comprises utilizing a scripting bridge.