Detection: Windows Cloud Sensitive File Read Access By Uncommon Process

Updated Date: 2026-08-19 ID: 313e4f5c-add3-4b4d-8348-6a009ce5fe40 Author: Teoderick Contreras, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

This analytic detects uncommon processes reading or requesting read access to sensitive files from cloud providers on Windows endpoints. It monitors Windows Security Event 4663 for ReadData (AccessMask 0x1) operations against sensitive files from cloud providers such as Azure. Access by any process outside the known toolchain may indicate credential theft or cloud identity reconnaissance activity, including infostealer behavior such as one observed in Vidar Stealer variants. This detection currently only supports Azure sensitive files, but will be extended to support other cloud providers in the future.

Search

 1`wineventlog_security`
 2EventCode=4663
 3ObjectType="File"
 4NOT process_path IN (
 5    "*:\\AppData\\Local\\Programs\\Python\\*\\python.exe",
 6    "*:\\AppData\\Local\\Python\\bin\\python.exe",
 7    "*:\\AppData\\Local\\Python\\pythoncore-*\\python.exe",
 8    "*:\\Program Files\\Azure Dev CLI\\azd.exe",
 9    "*:\\Program Files\\Microsoft SDKs\\Azure\\CLI2\\python.exe",
10    "*:\\Program Files\\Microsoft VS Code\\Code.exe",
11    "*:\\Program Files\\nodejs\\node.exe",
12    "*:\\Program Files\\PowerShell\\7-preview\\pwsh.exe",
13    "*:\\Program Files\\PowerShell\\7\\pwsh.exe",
14    "*:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
15    "*:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe",
16    "*\\.azd\\bin\\azd.exe",
17    "*\\AppData\\Local\\Microsoft\\powershell\\pwsh.exe",
18    "*\\AppData\\Local\\Programs\\Azure Dev CLI\\azd.exe",
19    "*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe"
20)
21ObjectName IN (
22    "*\\.azure\\accessTokens.json",
23    "*\\.azure\\azureProfile.json",
24    "*\\.azure\\msal_token_cache.json",
25    "*\\.azure\\TokenCache.dat",
26    "*\\Windows Azure Powershell\\TokenCache.dat"
27)

We select only read-related operations: 0x1 = ReadData (or ListDirectory)

 1
 2
 3| eval AccessMask_ = tonumber(AccessMask, 16)
 4
 5| where (bit_and(AccessMask_, 1) != 0)
 6
 7
 8| stats count min(_time) as firstTime
 9              max(_time) as lastTime
10  by signature_id signature
11     ObjectType file_path file_name
12     process_path process_name process_id
13     AccessMask src_user dest
14
15
16| `security_content_ctime(firstTime)`
17
18| `security_content_ctime(lastTime)`
19
20| `windows_cloud_sensitive_file_read_access_by_uncommon_process_filter`

Data Source

Name	Platform	Sourcetype	Source
Windows Event Log Security 4663	Windows	`'XmlWinEventLog'`	`'XmlWinEventLog:Security'`

Macros Used

Name	Value
security_content_ctime	`convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)`
windows_cloud_sensitive_file_read_access_by_uncommon_process_filter	`search *`

windows_cloud_sensitive_file_read_access_by_uncommon_process_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1528	Steal Application Access Token	Credential Access

Exploitation

DE.AE

CIS 10

APT29

Leviathan

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	No
Creates Intermediate Finding (Risk Event)	Yes

Anomaly detections generate Intermediate Findings (Risk Events). They do not generate a Finding (Notable) directly.

Implementation

To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. To enable Event ID 4663, enable object access auditing through Group Policy: Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Object Access > Audit File System, then enable Success auditing. Enable Failure auditing if your environment also requires denied access attempts. Event ID 4663 is only generated for files with a matching System Access Control List (SACL), so configure auditing on the relevant sensitive files from cloud providers.

Known False Positives

False positives are expected from legitimate tooling. The detection excludes the Azure CLI bundled Python interpreter, Windows PowerShell, PowerShell 7+, VS Code, and the Azure Developer CLI by process path. Residual false positives may arise from CI/CD agents (e.g., Azure DevOps self-hosted runners, GitHub Actions runners) that invoke az or Azure PowerShell from non-standard install paths not covered by the exclusion list, backup or DLP agents that scan user profile directories, and custom automation scripts that shell out to Azure CLI from an unexpected working directory. Tune by adding confirmed-legitimate process paths and file paths to the companion filter macro windows_cloud_sensitive_file_read_access_by_uncommon_process_filter.

Associated Analytic Story

Vidar Stealer

Intermediate Findings

Message	Entity Field	Entity Type	Risk Score
An uncommon process [$process_name$] accessing sensitive file [$file_path$] with AccessMask [$AccessMask$] on $dest$	dest	system	20

Threat Objects

Field	Type
process_name	process_name

References

https://www.trendmicro.com/en_us/research/25/j/how-vidar-stealer-2-upgrades-infostealer-capabilities.html

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`XmlWinEventLog:Security`	`XmlWinEventLog`
Integration	✅ Passing	Dataset	`XmlWinEventLog:Security`	`XmlWinEventLog`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1