Classification:

attack

Tactic:

TA0010-exfiltration

Technique:

T1567-exfiltration-over-web-service

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detect when a single user downloads an unusually high number of different report types from Workday within a short time period.

Technical Context

Workday is our Human Resources Information System containing sensitive employee data. When a user downloads many different types of reports in a short timeframe, this could indicate reconnaissance activity or data exfiltration attempts. Legitimate business use typically involves downloading specific reports for defined purposes, not mass collection of diverse report types.

Triage and Response

Refer to the following fields when investigating:

• User: {{@usr.email}}
• Number of different reports downloaded: {{unique_reports}}

1. Review the user’s role and job responsibilities to determine if downloading multiple different reports is justified for their position.
2. Examine the specific report types being downloaded (@evt.name) to assess the sensitivity and scope of data accessed.
3. Check the IP addresses and user agents for relevant threat intelligence or suspicious characteristics.
4. Look at the timing pattern of downloads. Rapid sequential downloads may indicate automated collection.
5. Review recent and historical Workday activity by the user ({{@usr.email}}) for any abnormal patterns of behavior.
6. Reach out to the user’s manager or HR team to verify whether the activity is expected.
7. If the nature of the activity is suspicious and requires further investigation, declare an incident.