Sunturai
Back to results
InformationalSplunk security contentTeoderick Contreras +1

Windows Cloud Sensitive File Read Access By Uncommon Process

This analytic detects uncommon processes reading or requesting read access to sensitive files from cloud providers on Windows endpoints. It monitors Windows Security Event 4663 for ReadData (AccessMask 0x1)…

Description

This analytic detects uncommon processes reading or requesting read access to sensitive files from cloud providers on Windows endpoints. It monitors Windows Security Event 4663 for ReadData (AccessMask 0x1) operations against sensitive files from cloud providers such as Azure. Access by any process outside the known toolchain may indicate credential theft or cloud identity reconnaissance activity, including infostealer behavior such as one observed in Vidar Stealer variants. This detection currently only supports Azure sensitive files, but will be extended to support other cloud providers in the future.

Detection logic

Detection requirements

Platform
ContainersIaaSIdentity ProviderOffice SuiteSaaS

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
windows_event_log_security_4663

Known benign triggers

  • False positives are expected from legitimate tooling. The detection excludes the Azure CLI bundled Python interpreter, Windows PowerShell, PowerShell 7+, VS Code, and the Azure Developer CLI by process path. Residual false positives may arise from CI/CD agents (e.g., Azure DevOps self-hosted runners, GitHub Actions runners) that invoke az or Azure PowerShell from non-standard install paths not covered by the exclusion list, backup or DLP agents that scan user profile directories, and custom automation scripts that shell out to Azure CLI from an unexpected working directory. Tune by adding confirmed-legitimate process paths and file paths to the companion filter macro windows_cloud_sensitive_file_read_access_by_uncommon_process_filter.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice