OnTrac Network Breach: Data Exfiltration Detection and Incident Response Playbook

---
title: Suspicious Bulk Database Export Activity
id: 3d8f2c1a-7b4e-4a9d-8c5f-2e1a3b4c5d6e
status: experimental
description: Detects unusual bulk export operations from customer databases, indicating potential data exfiltration similar to OnTrac breach patterns
references:
  - https://attack.mitre.org/techniques/T1046/
  - https://attack.mitre.org/techniques/T1567/
author: Security Arsenal
date: 2026/04/02
tags:
  - attack.collection
  - attack.t1567
  - attack.exfiltration
logsource:
  category: database
detection:
  selection:
    DatabaseOperation|contains:
      - 'SELECT'
      - 'EXPORT'
      - 'DUMP'
      - 'COPY'
    RowCount|gt: 1000
  timeframe: 5m
condition: selection | count() > 3
falsepositives:
  - Legitimate database backups
  - Scheduled reporting jobs
level: high
---
title: Large File Transfer from Corporate Systems
id: 7a1f9e3d-4c2b-5a6d-8e9f-1b2c3d4e5f6a
status: experimental
description: Detects unusually large outbound file transfers from corporate systems, characteristic of data exfiltration incidents like OnTrac
references:
  - https://attack.mitre.org/techniques/T1041/
  - https://attack.mitre.org/techniques/T1567/
author: Security Arsenal
date: 2026/04/02
tags:
  - attack.exfiltration
  - attack.t1041
  - attack.t1567.002
logsource:
  category: network_connection
detection:
  selection:
    Direction: 'outbound'
    DestinationPort|notin:
      - 80
      - 443
      - 8080
      - 53
    BytesSent|gt: 52428800
  condition: selection
falsepositives:
  - Legitimate large file uploads
  - Software updates
level: medium
---
title: Suspicious Access to Customer Data Tables
id: 9f4e2d1c-6a3b-7c8d-9e0f-2a3b4c5d6e7f
status: experimental
description: Detects anomalous query patterns against customer PII tables, indicative of reconnaissance or data harvesting in logistics breaches
references:
  - https://attack.mitre.org/techniques/T1087/
  - https://attack.mitre.org/techniques/T1115/
author: Security Arsenal
date: 2026/04/02
tags:
  - attack.discovery
  - attack.t1087
  - attack.collection
logsource:
  category: database
detection:
  selection:
    Query|contains:
      - 'customer'
      - 'address'
      - 'contact'
      - 'personal'
      - 'shipment'
    UserName|contains:
      - 'admin'
      - 'service'
      - 'svc'
  filter:
    Application|contains:
      - 'reporting'
      - 'backup'
  condition: selection and not filter
falsepositives:
  - Authorized customer service queries
  - Scheduled data processing
level: high

// Hunt for suspicious database access patterns
let HighVolumeQueries = SecurityEvent
| where EventID == 4664 // An operation was attempted on an object
| where ObjectType contains "DATABASE"
| extend TableName = tostring(ObjectName)
| where TableName has "customer" or TableName has "personal" or TableName has "address"
| summarize count() by Account, Computer, TableName, bin(TimeGenerated, 5m)
| where count_ > 100;
HighVolumeQueries
| join kind=inner (
    SecurityEvent 
    | where EventID == 4624 // Logon Type
    | summarize LogonCount = count() by Account, Computer, bin(TimeGenerated, 5m)
) on Account, Computer
| project TimeGenerated, Account, Computer, TableName, QueryCount = count_, LogonCount
| sort by QueryCount desc;

// Hunt for large outbound data transfers
let DataExfilIndicators = DeviceNetworkEvents
| where ActionType == "ConnectionAllowed" or ActionType == "ConnectionSuccess"
| where InitiatingProcessHasSignificantRights
| extend BytesSent = coalesce(SentBytes, 0), BytesReceived = coalesce(ReceivedBytes, 0)
| where BytesSent > 52428800 // 50MB threshold
| where RemotePort !in (80, 443, 8080, 53)
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFolderPath, RemoteUrl, RemoteIP, RemotePort, BytesSent
| summarize TotalBytesSent = sum(BytesSent), ConnectionCount = count() by DeviceName, InitiatingProcessAccountName, RemoteIP, RemoteUrl, bin(TimeGenerated, 1h)
| sort by TotalBytesSent desc;
DataExfilIndicators
| where TotalBytesSent > 104857600 // 100MB per hour
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, RemoteIP, RemoteUrl, TotalBytesSent, ConnectionCount;

-- Hunt for suspicious processes accessing customer data files
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime,
       User, Size, Mtime
FROM pslist()
LEFT JOIN foreach(
    SELECT * FROM glob(globs='\\*\\*\\*customer*')
    WHERE Size > 0
) AS File ON CommandLine =~ File.Path
WHERE CommandLine =~ '(copy|xcopy|robocopy|export|compress|archive)'
   OR Exe =~ '(\\\\ProgramData\\|\\\\Temp\\)'
   OR Name IN ('powershell.exe', 'cmd.exe', 'wscript.exe', 'cscript.exe')
   AND CommandLine =~ '(Invoke-WebRequest|Net.WebClient|DownloadData)'

-- Hunt for network connections to non-standard ports
SELECT Pid, ProcessName, RemoteAddress, RemotePort, State, CreateTime, Username
FROM netstat()
WHERE RemotePort NOT IN (80, 443, 8080, 53, 135, 139, 445, 3389)
   AND State = 'ESTABLISHED'
   AND (ProcessName =~ '(powershell|cmd|python|perl|ruby)'
        OR Username =~ '(svc|admin|service)')

# OnTrac Breach Response - Immediate Security Hardening Script
# Run with elevated privileges on all Windows endpoints

# Write-Output "[+] Starting security hardening for OnTrac-style breach response"

# 1. Audit and Restrict Administrative Privileges
Write-Output "[*] Auditing administrative group memberships..."
$AdminGroups = Get-LocalGroup | Where-Object { $_.SID.Value -like '*-512' -or $_.SID.Value -like '*-544' -or $_.Name -like '*admin*' }
foreach ($group in $AdminGroups) {
    $members = Get-LocalGroupMember -Group $group.Name -ErrorAction SilentlyContinue
    if ($members) {
        Write-Output "[!] Admin group '$($group.Name)' has $($members.Count) members:"
        $members | ForEach-Object { Write-Output "    - $($_.Name) ($($_.SID.Value))" }
    }
}

# 2. Identify Suspicious Recent Services
Write-Output "[*] Checking for recently created suspicious services..."
$RecentServices = Get-WmiObject Win32_Service | 
    Where-Object { $_.InstallDate -and (Get-Date $_.InstallDate) -gt (Get-Date).AddDays(-7) }
if ($RecentServices) {
    Write-Output "[!] Services created in the last 7 days:"
    $RecentServices | ForEach-Object { 
        Write-Output "    - $($_.Name) ($($_.DisplayName)) - Path: $($_.PathName)"
    }
}

# 3. Audit Remote Desktop/SSH Access
Write-Output "[*] Auditing remote access configurations..."
$RDPEnabled = (Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name 'fDenyTSConnections').fDenyTSConnections -eq 0
if ($RDPEnabled) {
    Write-Output "[!] RDP is ENABLED - Consider disabling if not required"
}

# 4. Check for Unusual Scheduled Tasks
Write-Output "[*] Auditing scheduled tasks for persistence mechanisms..."
$SuspiciousTasks = Get-ScheduledTask | 
    Where-Object { $_.Actions.Execute -and 
                   ($_.Actions.Execute -match '(powershell|cmd|wscript|cscript)' -or
                    $_.Actions.Execute -match '(temp|appdata|public)') }
if ($SuspiciousTasks) {
    Write-Output "[!] Potentially suspicious scheduled tasks found:"
    $SuspiciousTasks | ForEach-Object { 
        Write-Output "    - $($_.TaskName): $($_.Actions.Execute)"
    }
}

# 5. Enable Enhanced Windows Logging for Incident Response
Write-Output "[*] Configuring enhanced logging for IR..."
auditpol /set /subcategory:'Security Group Management' /success:enable /failure:enable 2>$null
auditpol /set /subcategory:'Process Creation' /success:enable /failure:enable 2>$null
auditpol /set /subcategory:'Logoff' /success:enable /failure:enable 2>$null
auditpol /set /subcategory:'Logon' /success:enable /failure:enable 2>$null
auditpol /set /subcategory:'Special Logon' /success:enable /failure:enable 2>$null
auditpol /set /subcategory:'Process Termination' /success:enable /failure:enable 2>$null
auditpol /set /subcategory:'Network Logon' /success:enable /failure:enable 2>$null

Write-Output "[+] Security hardening script completed"