Detecting Shadow IT and Massive Cloud Storage Uploads in Enterprise Networks

Employees often utilize unapproved cloud services to bypass storage restrictions or back up work files. In worst-case scenarios, departing staff or malicious insiders stage corporate data exfiltration through high-capacity personal cloud storage providers.

Here is how to monitor endpoint egress transfer volumes using DeviceNetworkEvents.

Log Source

• Microsoft Defender for Endpoint: DeviceNetworkEvents

High-Volume Cloud Upload Detection Query

// Detect Large File Uploads (> 200MB) to Consumer Cloud Storage and File Sharing Sites
let timeRange = 24h;
let uploadSizeThresholdBytes = 200 * 1024 * 1024; // 200 MB
let cloudStorageDomains = dynamic([
    "mega.nz",
    "dropbox.com",
    "wetransfer.com",
    "mediafire.com",
    "sendspace.com",
    "file.io",
    "anonfiles.com",
    "box.com"
]);
DeviceNetworkEvents
| where TimeGenerated >= ago(timeRange)
| where RemoteUrl has_any (cloudStorageDomains)
| summarize 
    TotalBytesSent = sum(SentBytes),
    ConnectionCount = count(),
    FirstUpload = min(TimeGenerated),
    LastUpload = max(TimeGenerated)
    by DeviceName, InitiatingProcessAccountName, RemoteUrl, bin(TimeGenerated, 1h)
| where TotalBytesSent >= uploadSizeThresholdBytes
| extend TotalMegabytesSent = round(TotalBytesSent / (1024 * 1024), 2)
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, RemoteUrl, TotalMegabytesSent, ConnectionCount
| order by TotalMegabytesSent desc

Incident Response Guidance

• Verify whether the destination domain is an approved business collaboration partner.
• Correlate against DLP or USB file copy events to see if data was archived prior to upload.

MITRE ATT&CK Mapping

• Tactic: Exfiltration (TA0010)
• Technique: Exfiltration Over Web Service (T1567)