Data Broker Sentencing: 7M Elderly Americans' Data Exfiltration — Detection and Prevention Guide

---
title: Suspicious Bulk Database Export Activity
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects bulk data export from database management tools or applications
references:
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2025/01/06
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - '\\sqlplus.exe'
      - '\\sqlcmd.exe'
      - '\\bcp.exe'
      - '\\mysql.exe'
      - '\\psql.exe'
      - '\\pg_dump.exe'
      - '\\exp.exe'
      - '\\expdp.exe'
      - '\\mysqldump.exe'
  condition: selection and not filter
falsepositives:
  - Legitimate database backups
  - Authorized data exports by IT staff
level: high
---
title: Large File Creation in User Directories (Potential Data Exfiltration)
id: b2c3d4e5-f6a7-8901-bcde-f12345678901
status: experimental
description: Detects creation of large files in user directories that may indicate bulk data export
references:
  - https://attack.mitre.org/techniques/T1567/
author: Security Arsenal
date: 2025/01/06
tags:
  - attack.exfiltration
  - attack.t1567
logsource:
  category: file_create
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\\Downloads\\'
      - '\\Desktop\\'
      - '\\Documents\\'
    TargetFilename|endswith:
      - '.csv'
      - '.xlsx'
      - '.xls'
      - '.zip'
  filter:
    FileSize < 10485760
  condition: selection and not filter
falsepositives:
  - Legitimate work with large files
level: medium
---
title: Unusual Database Query Patterns
id: c3d4e5f6-a7b8-9012-cdef-123456789012
status: experimental
description: Detects suspicious database query patterns indicating potential data exfiltration
references:
  - https://attack.mitre.org/techniques/T1119/
author: Security Arsenal
date: 2025/01/06
tags:
  - attack.collection
  - attack.t1119
logsource:
  product: azure
  service: azureactivity
detection:
  selection:
    OperationName|contains:
      - 'Microsoft.Sql/servers/databases/executeQuery'
      - 'Microsoft.DataLake/accounts/read'
  timeframe: 1h
  condition: selection | count() > 100
falsepositives:
  - Authorized reporting queries
  - Business intelligence activities
level: high

// Hunt for suspicious bulk data export activities
// Detect large file transfers from endpoints
let FileTransferThreshold = 10485760; // 10MB threshold
DeviceFileEvents
| where ActionType == "FileCreated"
| where FileName has_any (".csv", ".xlsx", ".xls", ".zip", ".sql", ".bak", ".dump")
| where FileSize > FileTransferThreshold
| where FolderPath has_any (@'Downloads', @'Desktop', @'Documents', @'AppData')
| project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, FileSize, FolderPath, SHA256
| order by Timestamp desc
| join kind=leftouter (
    DeviceNetworkEvents
    | where ActionType == "ConnectionEstablished"
    | where RemotePort in (80, 443, 21, 22, 445)
    | summarize ConnectionCount=count(), RemoteIPs=make_set(RemoteIP) by DeviceId, Timestamp
    | extend TimeWindow = bin(Timestamp, 1h)
) on DeviceId, Timestamp
| where isnotempty(ConnectionCount) and ConnectionCount > 5
| project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, FileSize, FolderPath, SHA256, ConnectionCount, RemoteIPs
| top 100 by Timestamp desc

-- Hunt for indicators of data exfiltration
-- Check for large recently created files in user directories
LET LargeFiles = SELECT FullPath, Size, Mtime, Mode.SysType, 
       Sys.Users[user=Uid].Name as User
FROM glob(globs="/**/*.{csv,xlsx,xls,zip,sql,bak,dump}")
WHERE Size > 10485760  -- Files larger than 10MB
  AND Mtime < now() - 7d  -- Created in last 7 days

-- Check for database dump executables running
LET DumpProcesses = SELECT Pid, Name, Exe, CommandLine, 
       Sys.Users[user=Uid].Name as User, Ctime
FROM pslist()
WHERE Name =~ 'mysqldump' 
   OR Name =~ 'pg_dump' 
   OR Name =~ 'expdp'
   OR Name =~ 'exp'
   OR Name =~ 'bcp'
   OR CommandLine =~ 'INTO OUTFILE'
   OR CommandLine =~ 'spool'

-- Check for network connections to unusual destinations during file creation
LET SuspiciousConnections = SELECT Fd, RemoteAddress, RemotePort, State,
       Pid.Name as ProcessName, Sys.Users[user=Uid].Name as User
FROM netstat()
WHERE RemoteAddress != '0.0.0.0' AND RemoteAddress != '::' AND RemoteAddress != '127.0.0.1'
   AND State =~ 'ESTABLISHED'

-- Combine results for analysis
SELECT * FROM foreach(row={
    SELECT 'LargeFiles' as Type, * FROM limit(rows=LargeFiles, n=100)
}, query={
    SELECT Type, * FROM scope()
})
UNION
SELECT * FROM foreach(row={
    SELECT 'DumpProcesses' as Type, * FROM limit(rows=DumpProcesses, n=100)
}, query={
    SELECT Type, * FROM scope()
})
UNION
SELECT * FROM foreach(row={
    SELECT 'SuspiciousConnections' as Type, * FROM limit(rows=SuspiciousConnections, n=100)
}, query={
    SELECT Type, * FROM scope()
})

# Data Exfiltration Prevention and Hardening Script
# Run with Administrator privileges

# Function to enable advanced audit policy for file access
function Enable-AdvancedAuditing {
    Write-Host "Configuring advanced audit policies for file access..." -ForegroundColor Yellow
    auditpol /set /subcategory:"File System" /success:enable /failure:enable
    auditpol /set /subcategory:"Kernel Object" /success:enable /failure:enable
    auditpol /set /subcategory:"Handle Manipulation" /success:enable /failure:enable
}

# Function to configure object access auditing for sensitive directories
function Set-SensitiveDirectoryAuditing {
    param(
        [string]$Path
    )
    
    if (Test-Path $Path) {
        Write-Host "Configuring auditing for $Path..." -ForegroundColor Yellow
        $acl = Get-Acl $Path
        $auditRule = New-Object System.Security.AccessControl.FileSystemAuditRule(
            "Everyone",
            "FullControl",
            "ContainerInherit,ObjectInherit",
            "None",
            "Success,Failure"
        )
        $acl.AddAuditRule($auditRule)
        Set-Acl $Path $acl
    }
}

# Function to restrict common data export tools
function Restrict-ExportTools {
    Write-Host "Restricting access to common data export tools..." -ForegroundColor Yellow
    
    $exportTools = @(
        "C:\Program Files\MySQL\MySQL Server*\bin\mysqldump.exe",
        "C:\Program Files\PostgreSQL*\bin\pg_dump.exe",
        "C:\Program Files\Microsoft SQL Server\*\Binn\sqlcmd.exe",
        "C:\Program Files\Microsoft SQL Server\*\Binn\bcp.exe"
    )
    
    foreach ($tool in $exportTools) {
        $toolPaths = Get-Item -Path $tool -ErrorAction SilentlyContinue
        foreach ($path in $toolPaths) {
            $acl = Get-Acl $path.FullName
            $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule(
                "BUILTIN\Users",
                "ReadAndExecute",
                "None",
                "None",
                "Deny"
            )
            $acl.SetAccessRule($accessRule)
            Set-Acl $path.FullName $acl
            Write-Host "Restricted access to: $($path.FullName)" -ForegroundColor Green
        }
    }
}

# Function to enable PowerShell transcription for audit trail
function Enable-PSTranscription {
    Write-Host "Enabling PowerShell transcription..." -ForegroundColor Yellow
    
    $transcriptPath = "$env:ProgramData\PowerShellTranscripts"
    if (-not (Test-Path $transcriptPath)) {
        New-Item -Path $transcriptPath -ItemType Directory -Force | Out-Null
    }
    
    $registryPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription"
    if (-not (Test-Path $registryPath)) {
        New-Item -Path $registryPath -Force | Out-Null
    }
    
    Set-ItemProperty -Path $registryPath -Name "EnableTranscripting" -Value 1 -Type DWord
    Set-ItemProperty -Path $registryPath -Name "EnableInvocationHeader" -Value 1 -Type DWord
    Set-ItemProperty -Path $registryPath -Name "OutputDirectory" -Value $transcriptPath
    Set-ItemProperty -Path $registryPath -Name "IncludeInvocationHeader" -Value 1 -Type DWord
    
    Write-Host "PowerShell transcription enabled to: $transcriptPath" -ForegroundColor Green
}

# Function to configure Windows Event Log size
function Set-EventLogSize {
    Write-Host "Configuring Windows Event Log sizes..." -ForegroundColor Yellow
    
    $logNames = @("Security", "Application", "System", "Microsoft-Windows-PowerShell/Operational")
    $maxSize = 10240MB  # 10GB
    
    foreach ($logName in $logNames) {
        try {
            $log = Get-WinEvent -ListLog $logName -ErrorAction Stop
            $log.MaximumSizeInBytes = $maxSize
            $log.LogMode = "Circular"
            $log.SaveChanges()
            Write-Host "Configured $logName with max size: $maxSize" -ForegroundColor Green
        } catch {
            Write-Host "Failed to configure $logName : $($_.Exception.Message)" -ForegroundColor Red
        }
    }
}

# Function to create data loss prevention alerts
function Create-DLPAlerts {
    Write-Host "Creating Data Loss Prevention monitoring..." -ForegroundColor Yellow
    
    # Create scheduled task to monitor for large file creation
    $scriptPath = "$env:ProgramFiles\SecurityArsenal\MonitorLargeFiles.ps1"
    $scriptContent = @'
# Monitor for large file creation in user directories
$watcher = New-Object System.IO.FileSystemWatcher
$watcher.Path = "C:\Users"
$watcher.IncludeSubdirectories = $true
$watcher.EnableRaisingEvents = $true

$largeFileAction = {
    $path = $Event.SourceEventArgs.FullPath
    $size = (Get-Item $path).Length
    
    if ($size -gt 10MB) {
        $message = "Large file detected: $path ($size bytes)"
        Write-EventLog -LogName "Security" -Source "DLP Monitor" -EntryType Warning -EventId 9999 -Message $message
    }
}

Register-ObjectEvent -InputObject $watcher -EventName Created -Action $largeFileAction
'@
    
    $directory = Split-Path $scriptPath -Parent
    if (-not (Test-Path $directory)) {
        New-Item -Path $directory -ItemType Directory -Force | Out-Null
    }
    
    $scriptContent | Out-File -FilePath $scriptPath -Force
    
    $action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-NoProfile -ExecutionPolicy Bypass -File `"$scriptPath`""
    $trigger = New-ScheduledTaskTrigger -AtStartup
    $principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest
    Register-ScheduledTask -TaskName "SecurityArsenal Large File Monitor" -Action $action -Trigger $trigger -Principal $principal -Description "Monitor for large file creation in user directories" | Out-Null
    
    Write-Host "Created DLP monitoring scheduled task" -ForegroundColor Green
}

# Main execution
Write-Host "Starting Data Exfiltration Prevention Hardening..." -ForegroundColor Cyan
Write-Host "=================================================" -ForegroundColor Cyan

Enable-AdvancedAuditing
Set-SensitiveDirectoryAuditing -Path "C:\ProgramData"
Set-SensitiveDirectoryAuditing -Path "C:\Users"
Restrict-ExportTools
Enable-PSTranscription
Set-EventLogSize
Create-DLPAlerts

Write-Host "=================================================" -ForegroundColor Cyan
Write-Host "Hardening complete. Review logs for any alerts." -ForegroundColor Green