How do we detect large uploads to cloud storage from a server?
Compare each server's outbound traffic with its own normal, and look closely at cloud storage destinations. Many servers never need to send much to the internet, so a database or file server uploading gigabytes to a file-sharing or cloud storage service is unusual in itself; ransomware advisories describe tools such as Rclone being used in exactly this way before encryption. Practical steps: restrict which servers may reach the internet at all, log outbound connections at the firewall or proxy, and review per-server volumes to cloud storage every week. Where you use a cloud service officially, separate its legitimate destinations from consumer accounts at the proxy if you can. NetSenX flags unusual outbound data volume per host, with destination and time, on every plan; it does not see the content of encrypted uploads or which account they went to.
Read next
Related questions
- What is PsExec or admin-share abuse, and why does antivirus not flag it?
- Can attackers move through our network with stolen passwords and no malware?
- Should we detect lateral movement from authentication logs or from network flows?
- What is graph-based detection of lateral movement?
- Do rule-based security tools miss new attack paths?