Attempt to exfiltrate a 1Password item by user

문서 > Datadog 보안 > OOTB Rules > Attempt to exfiltrate a 1Password item by user

Classification:

attack

Tactic:

TA0006-credential-access

Technique:

T1555-credentials-from-password-stores

Set up the 1password integration.

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Goal

Detect possible exfiltration attempts from 1Password through an item export.

Strategy

This rule monitors 1Password audit logs to determine when the export item usage action occurs. This could indicate exfiltration attempts from 1Password by downloading or exporting items.

Triage & response

Investigate the {{@usr.email}} attempting to download or export item {{@item_uuid}} from vault {{@vault_uuid}}.
If this action was unintend by the user:
- Rotate the user’s 1Password master password
- Identify all the items that were exported and rotate the necessary authentication credentials