File Access

To events where a file is opened or accessed, making its contents available to the requester. This includes reading, executing, or interacting with files by authorized or unauthorized entities. Examples include logging file access events (e.g., Windows Event ID 4663), monitoring file reads, and detecting unusual file access patterns. Examples:

• File Read Operations: A user opens a sensitive document (e.g., financial_report.xlsx) on a shared drive.
• File Execution: A script or executable file is accessed and executed (e.g., malware.exe is run from a temporary directory).
• Unauthorized File Access: An unauthorized user attempts to access a protected configuration file (e.g., /etc/passwd on Linux or System32 files on Windows).
• File Access Patterns: Bulk access to multiple files in a short time (e.g., mass access to documents on a file server).
• File Access via Network: Files on a network share are accessed remotely (e.g., logs of SMB file access).

This data component can be collected through the following measures:

Windows

• Windows Event Logs: Event ID 4663: Captures file system auditing details, including who accessed the file, access type, and file name.
• Sysmon:
  • Event ID 11: Logs file creation time changes.
  • Event ID 1 (process creation): Can provide insight into files executed.
• PowerShell: Commands to monitor file access in real-time: Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4663}

Linux

• Auditd: Monitor file access events using audit rules: auditctl -w /path/to/file -p rwxa -k file_access
• View logs: ausearch -k file_access
• Inotify: Use inotify to track file access on Linux: inotifywait -m /path/to/watch -e access

macOS

• Unified Logs: Monitor file access using the macOS Unified Logging System.
• FSEvents: File System Events can track file accesses: fs_usage | grep open

Network Devices

• SMB/CIFS Logs: Monitor file access over network shares using logs from SMB or CIFS protocol.
• NAS Logs: Collect logs from network-attached storage systems for file access events.

SIEM Integration

• Collect file access logs from all platforms (Windows, Linux, macOS) and centralize in a SIEM for correlation and analysis.