Box malicious file detected

This rule is part of a beta feature. To learn more, contact Support.
box

Classification:

attack

Tactic:

TA0002-execution

Technique:

T1204-user-execution

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Goal

Detects when Box identifies a file containing malware, indicating a potential threat to users or shared content.

Strategy

Monitor security events where a file uploaded to Box is flagged as malicious to prevent distribution of infected content.

Triage and Response

  1. Review the user {{@usr.email}} who uploaded the malicious file.
  2. Note the file name {{@source.item_name}} to assess its context, location, and sharing status.
  3. Quarantine or delete the malicious file and notify involved users.
  4. Review user activity and scan associated files for additional threats.