Impact

If attackers successfully transfer unusually large files for lateral movement or data exfiltration, organizations face significant risks including the theft of sensitive information, establishment of further persistence within the network, and potential system compromise. The consolidation of data into large files allows adversaries to achieve their objectives with a higher likelihood of evading traditional security alerts. This could lead to severe data breaches, regulatory non-compliance fines, and substantial reputational damage for the affected entities.

Recommendation

• Enable host.ip field collection for Elastic Defend events, especially for versions 8.18 and above, by following Elastic's official configuration steps outlined in their helper guide.
• Install the Lateral Movement Detection integration assets in Kibana, ensuring all prerequisites are met and preconfigured anomaly detection jobs are added as described in the setup section.
• Review the alert details for Unusual Remote File Size to identify specific remote hosts and file sizes involved in detected anomalies.
• Analyze network logs to trace the origin and destination of any suspicious large file transfers.
• Implement network segmentation to limit lateral movement capabilities within the environment if a detected anomaly indicates malicious activity.
• Conduct thorough analysis of the contents and origin of unusually large file transfers to determine if sensitive data was involved and reset credentials for any associated compromised accounts.