1Password vault export attempt by user

1password

Classification:

attack

Tactic:

TA0010-exfiltration

Technique:

T1567-exfiltration-over-web-service

Set up the 1password integration.

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Goal

Detect possible exfiltration attempts from 1Password through a vault export.

Strategy

This rule monitors 1Password audit logs to determine when the export item usage action occurs on a vault. This could indicate exfiltration attempts from 1Password by downloading or exporting items within a vault.

Triage & response

  1. Investigate the {{@usr.email}} attempting to download or export vault {{@vault_uuid}}.
  2. If this action was unintended by the user:
    • Rotate the user’s 1Password master password
    • Identify all the items within the vault that were exported and rotate the necessary authentication credentials