The "Data Gathering" detection focuses on identifying activities that involve the collection and aggregation of information from within an organization's network. This activity can be a precursor to more severe attacks, as attackers often gather data to understand the environment, identify targets, and plan their next steps. Detecting data gathering is crucial to prevent potential data breaches, privilege escalation, and other malicious activities.
Scenario 1: An attacker who has gained access to the network starts querying Active Directory to gather information about users, groups, and computers. The detection is triggered by the high volume of directory service queries.
Scenario 2: An insider threat scenario where an employee uses automated scripts to collect sensitive customer data from various databases. The detection is triggered by the unusual volume and pattern of data access activities.
If this detection indicates a genuine threat, the organization faces significant risks:
Unauthorized access to and potential exfiltration of sensitive information.
Attackers can use gathered data to escalate privileges within the network.
Extensive data gathering can disrupt normal operations and impact system performance.
Data gathering involves the collection and aggregation of information from within an organization's network, often used by attackers for reconnaissance and planning further attacks.
Common signs include high-volume data access, multiple directory service queries, unusual file access patterns, and network scans.
Yes, legitimate administrative tasks, business processes, or security assessments can trigger this detection. It’s important to verify the context of the activity.
Vectra AI uses advanced AI algorithms to analyze network traffic and access logs, identifying patterns indicative of data gathering and correlating these with other suspicious behaviors.
The primary risks are data breaches, privilege escalation, operational disruptions, and compliance violations, which can lead to significant harm to the organization.
Monitor for unusual or high-volume access to sensitive files and databases, multiple queries to directory services, and network scans targeting various resources.
Data gathering can lead to unauthorized access to sensitive information, privilege escalation, operational disruption, and compliance violations.
Investigate the source of the data gathering activity, verify if it was authorized, check for other signs of malicious activity, and secure sensitive data and systems.
Tools like network traffic analyzers, threat detection and response solutions, and specialized monitoring solutions can help identify and verify data gathering activities.
Implement strong access controls, monitor data access and network traffic, use data loss prevention (DLP) tools, set up alerts for suspicious activity, and regularly audit data access and user activity.