Anomalous Database Export Activity

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

Adversaries may attempt to exfiltrate sensitive data by exporting databases. The query identifies users performing an "Export database" operation where one or more behavioral features deviate from the user''s baseline, peer group, or the tenant profile.

Attribute	Value
Type	Hunting Query
Solution	UEBA Essentials
ID	8cf3c78e-cd10-4bfb-bd69-d62dc7f375f1
Tactics	Collection
Techniques	T1530
Required Connectors	BehaviorAnalytics
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
BehaviorAnalytics	✓	✗	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Hunting Queries · Back to UEBA Essentials