https://www.veil-framework.com/component---src-components-page-tem…-sensitive-data-mdx-8cb81b6d6a3ccecfe268.js

1"use strict";(self.webpackChunkveil_framework=self.webpackChunkveil_framework||[]).push([[8088],{7202:function(e,t,n){n.r(t),n.d(t,{Head:function(){return h},default:function(){return E}});var a=n(8453),l=n(6540);function r(e){const t=Object.assign({h1:"h1",p:"p",h2:"h2",ul:"ul",li:"li",h3:"h3",strong:"strong",ol:"ol",a:"a"},(0,a.RP)(),e.components);return l.createElement(l.Fragment,null,l.createElement(t.h1,null,"Hunting Sensitive Data with Veil Framework"),"\n",l.createElement(t.p,null,"Data discovery — the process of identifying and locating sensitive information across an environment — is a critical phase of both legitimate security assessments and real-world attacks. Understanding how attackers find sensitive data is the foundation for building detection capabilities that catch this activity before exfiltration occurs."),"\n",l.createElement(t.p,null,"This page covers the techniques used for data discovery in lab environments, the telemetry that reveals this activity, and the detection strategies that defensive teams should implement."),"\n",l.createElement(t.h2,null,'What "Hunting Sensitive Data" Means in Practice'),"\n",l.createElement(t.p,null,"In a penetration test or purple team exercise, data discovery typically involves searching file shares, databases, email, and document repositories for information that would have business impact if compromised. The point is not to steal data — it is to demonstrate that the data is accessible and that the access was (or was not) detected."),"\n",l.createElement(t.p,null,"Common target data types:"),"\n",l.createElement(t.ul,null,"\n",l.createElement(t.li,null,"Credentials stored in files (scripts, configuration files, notes)"),"\n",l.createElement(t.li,null,"Financial records and PII"),"\n",l.createElement(t.li,null,"Intellectual property and trade secrets"),"\n",l.createElement(t.li,null,"Infrastructure documentation (network diagrams, architecture documents)"),"\n",l.createElement(t.li,null,"Backup files containing database dumps"),"\n"),"\n",l.createElement(t.h2,null,"Detection Opportunities"),"\n",l.createElement(t.p,null,"Data discovery generates telemetry at multiple levels:"),"\n",l.createElement(t.h3,null,"File Access Monitoring"),"\n",l.createElement(t.p,null,"When a user or process accesses file shares and reads files at scale, several monitoring points activate:"),"\n",l.createElement(t.ul,null,"\n",l.createElement(t.li,null,l.createElement(t.strong,null,"Event ID 5145")," — Network share access with object-level detail"),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,"Event ID 4663")," — File access audit events (requires object access auditing)"),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,"File integrity monitoring")," — Unexpected reads on sensitive directories"),"\n"),"\n",l.createElement(t.h3,null,"Behavioral Patterns"),"\n",l.createElement(t.p,null,"Data discovery produces distinctive behavioral patterns:"),"\n",l.createElement(t.ul,null,"\n",l.createElement(t.li,null,"A single account accessing dozens of shares in a short window"),"\n",l.createElement(t.li,null,"Sequential directory traversal across network shares"),"\n",l.createElement(t.li,null,"Large-volume file reads without corresponding business activity"),"\n",l.createElement(t.li,null,"Keyword searches against file contents (detectable through endpoint telemetry)"),"\n"),"\n",l.createElement(t.h3,null,"Network-Level Indicators"),"\n",l.createElement(t.ul,null,"\n",l.createElement(t.li,null,"High-volume SMB traffic from a single source to multiple file servers"),"\n",l.createElement(t.li,null,"Unusual data transfer volumes from endpoints that typically generate little network traffic"),"\n",l.createElement(t.li,null,"After-hours file access patterns"),"\n"),"\n",l.createElement(t.h2,null,"Building Detection Rules"),"\n",l.createElement(t.p,null,"Effective data discovery detection combines multiple indicators:"),"\n",l.createElement(t.ol,null,"\n",l.createElement(t.li,null,l.createElement(t.strong,null,"Baseline normal access patterns")," — Understand what legitimate file access looks like for each user role"),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,"Set thresholds")," — Define what constitutes anomalous file access volume"),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,"Correlate events")," — A single share access is not suspicious; accessing twenty shares in an hour may be"),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,"Alert on sensitive directories")," — High-value data locations should have tighter monitoring"),"\n"),"\n",l.createElement(t.h2,null,"Lab Exercise Design"),"\n",l.createElement(t.p,null,"When using the Veil Framework to test data discovery detection:"),"\n",l.createElement(t.ol,null,"\n",l.createElement(t.li,null,"Pre-stage sensitive data in known locations across your lab environment"),"\n",l.createElement(t.li,null,"Enable all relevant audit logging on file servers and endpoints"),"\n",l.createElement(t.li,null,"Run data discovery techniques from a test account"),"\n",l.createElement(t.li,null,"Verify that your SIEM generates appropriate alerts"),"\n",l.createElement(t.li,null,"Document which techniques were detected and which were missed"),"\n",l.createElement(t.li,null,"Tune detection rules based on findings"),"\n"),"\n",l.createElement(t.p,null,"The goal is not 100% detection — it is understanding your detection boundaries and making informed decisions about acceptable risk."),"\n",l.createElement(t.h2,null,"Related"),"\n",l.createElement(t.ul,null,"\n",l.createElement(t.li,null,l.createElement(t.strong,null,l.createElement(t.a,{href:"/hunting-users-veil-framework/"},"Hunting Users"))," — Detecting user enumeration"),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,l.createElement(t.a,{href:"/veil-powerview-usage-guide/"},"PowerView Usage Guide"))," — AD enumeration techniques"),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,l.createElement(t.a,{href:"/framework/"},"Framework Overview"))," — Architecture context"),"\n",l.createElement(t.li,null,l.createElement(t.strong,null,l.createElement(t.a,{href:"/guides/"},"Guides"))," — All available guides"),"\n"))}var s=function(e={}){const{wrapper:t}=Object.assign({},(0,a.RP)(),e.components);return t?l.createElement(t,e,l.createElement(r,e)):r(e)},i=n(9329),c=n(1744),o=n(8963),m=n(8752),u=n(7304);function d(e){if(!e)return null;try{return new Intl.DateTimeFormat("en-GB",{day:"numeric",month:"long",year:"numeric",timeZone:"UTC"}).format(new Date(e))}catch{return null}}function f({pageContext:e,children:t}){const{frontmatter:n}=e,a=(null==n?void 0:n.title)||"",r=(null==n?void 0:n.description)||"",s=(null==n?void 0:n.slug)||"",c=(null==n?void 0:n.heroImage)||null,f=(null==n?void 0:n.date)||null,E=(null==n?void 0:n.lastmod)||null,h=d(f),p=E&&E!==f?d(E):null;return l.createElement(i.A,null,c&&l.createElement(o.A,{title:a,subtitle:r,backgroundImage:c}),l.createElement("article",{className:"page-content"},l.createElement("div",{className:"container"},h&&l.createElement("p",{className:"post-meta"},l.createElement("time",{dateTime:f},"Published ",h),p&&l.createElement(l.Fragment,null," · ",l.createElement("time",{dateTime:E},"Updated ",p))),l.createElement("div",{className:"post-layout-grid"},l.createElement("div",{className:"post-main"},t),l.createElement("aside",{className:"post-sidebar","aria-label":"Sidebar"},l.createElement("div",{className:"post-sidebar-scroll"},l.createElement(u.A),l.createElement(m.A,{sourceUrl:s})))))))}function E(e){return l.createElement(f,e,l.createElement(s,e))}function h({pageContext:e}){const{frontmatter:t}=e,n=null!=t&&t.heroImage?`https://www.veil-framework.com${t.heroImage}`:null;

1return l.createElement(c.A,{title:null==t?void 0:t.title,description:null==t?void 0:t.description,pathname:null==t?void 0:t.slug},(null==t?void 0:t.date)&&l.createElement("meta",{property:"article:published_time",content:t.date}),(null==t?void 0:t.lastmod)&&l.createElement("meta",{property:"article:modified_time",content:t.lastmod}),n&&l.createElement("meta",{property:"og:image",content:n}),n&&l.createElement("meta",{name:"twitter:image",content:n}))}},7304:function(e,t,n){n.d(t,{A:function(){return r}});var a=n(6540);function l({href:e,children:t,className:n,...l}){return a.createElement("a",Object.assign({href:e,target:"_blank",rel:"sponsored nofollow noopener",className:n},l),t)}function r(){const e="/veil-recommends/infosec-fundamentals";return a.createElement("aside",{className:"fc-wrap","aria-label":"Recommended course"},a.createElement("div",{className:"fc-header"},a.createElement("span",{className:"fc-dot fc-dot-r","aria-hidden":"true"}),a.createElement("span",{className:"fc-dot fc-dot-a","aria-hidden":"true"}),a.createElement("span",{className:"fc-dot fc-dot-g","aria-hidden":"true"}),a.createElement("span",{className:"fc-header-label"},"course_spotlight.sh")),a.createElement(l,{href:e,className:"fc-image-link","aria-label":"View Information Security Fundamentals course"},a.createElement("img",{src:"/img/hero/infosec-fundamentals.webp",alt:"Information Security Fundamentals course cover",className:"fc-image",loading:"lazy",width:"300",height:"169"})),a.createElement("div",{className:"fc-body"},a.createElement("div",{className:"fc-tag"},"Recommended Course"),a.createElement("h3",{className:"fc-title"},a.createElement(l,{href:e,className:"fc-title-link"},"Information Security Fundamentals")),a.createElement("p",{className:"fc-desc"},"Build a solid foundation in cybersecurity. Covers network fundamentals, common attack vectors, defensive controls, and the mindset needed for security research."),a.createElement("ul",{className:"fc-features"},a.createElement("li",{className:"fc-feature"},a.createElement("span",{className:"fc-feature-icon","aria-hidden":"true"},"▸"),"Beginner-friendly — no prior experience needed"),a.createElement("li",{className:"fc-feature"},a.createElement("span",{className:"fc-feature-icon","aria-hidden":"true"},"▸"),"Network attacks & defences"),a.createElement("li",{className:"fc-feature"},a.createElement("span",{className:"fc-feature-icon","aria-hidden":"true"},"▸"),"Real-world security concepts")),a.createElement(l,{href:e,className:"fc-cta"},"View Course",a.createElement("span",{className:"fc-cta-arrow","aria-hidden":"true"}," →")),a.createElement("p",{className:"fc-disclosure"},"We may earn a commission if you enrol via our link, at no extra cost to you.")))}},8453:function(e,t,n){n.d(t,{RP:function(){return r}});var a=n(6540);const l=a.createContext({});function r(e){const t=a.useContext(l);return a.useMemo(()=>"function"==typeof e?e(t):{...t,...e},[t,e])}},8752:function(e,t,n){n.d(t,{A:function(){return l}});var a=n(6540);function l({sourceUrl:e}){const{0:t,1:n}=(0,a.useState)("idle"),{0:l,1:r}=(0,a.useState)("");return a.createElement("aside",{className:"nl-sw-wrap","aria-label":"Newsletter signup"},a.createElement("div",{className:"nl-sw-header"},a.createElement("span",{className:"nl-sw-dot nl-sw-dot-r","aria-hidden":"true"}),a.createElement("span",{className:"nl-sw-dot nl-sw-dot-a","aria-hidden":"true"}),a.createElement("span",{className:"nl-sw-dot nl-sw-dot-g","aria-hidden":"true"}),a.createElement("span",{className:"nl-sw-title"},"intel_feed.sh")),a.createElement("div",{className:"nl-sw-body"},a.createElement("p",{className:"nl-sw-prompt"},a.createElement("span",{className:"nl-sw-caret","aria-hidden":"true"},"$")," ","subscribe --to evasion-intel"),a.createElement("h3",{className:"nl-sw-heading"},"Stay ahead of the curve"),a.createElement("p",{className:"nl-sw-desc"},"AV bypass techniques, detection gaps, and lab-tested research — delivered before the mainstream catches up."),"done"===t?a.createElement("div",{className:"nl-sw-success",role:"status"},a.createElement("span",{className:"nl-sw-check","aria-hidden":"true"},"✓"),a.createElement("div",null,a.createElement("strong",null,"Subscribed."),a.createElement("br",null),a.createElement("span",{className:"nl-sw-success-sub"},"Confirm your email to activate."))):a.createElement("form",{onSubmit:async function(e){e.preventDefault();const t=e.currentTarget,a=new FormData(t);

1if(!a.get("company")){n("loading"),r("");try{const e=await fetch("/api/subscribe",{method:"POST",body:a}),l=await e.json();l.success?(n("done"),t.reset()):(n("err"),r(l.error||"Something went wrong."))}catch{n("err"),r("Network error — please try again.")}}},className:"nl-sw-form",noValidate:!0},a.createElement("input",{type:"hidden",name:"site",value:"veil-framework"}),a.createElement("input",{type:"hidden",name:"source_url",value:e||""}),a.createElement("input",{type:"text",name:"company",tabIndex:"-1","aria-hidden":"true",className:"nl-sw-hp",autoComplete:"off"}),a.createElement("label",{htmlFor:"nl-sw-name",className:"nl-sw-label"},"Your name"),a.createElement("input",{id:"nl-sw-name",type:"text",name:"name",placeholder:"alias or handle",required:!0,autoComplete:"given-name",className:"nl-sw-input",disabled:"loading"===t}),a.createElement("label",{htmlFor:"nl-sw-email",className:"nl-sw-label"},"Email address"),a.createElement("input",{id:"nl-sw-email",type:"email",name:"email",placeholder:"[email protected]",required:!0,autoComplete:"email",className:"nl-sw-input",disabled:"loading"===t}),"err"===t&&a.createElement("p",{className:"nl-sw-error",role:"alert"},l),a.createElement("button",{type:"submit",className:"nl-sw-btn",disabled:"loading"===t},"loading"===t?"Connecting…":"Subscribe to intel →"),a.createElement("p",{className:"nl-sw-legal"},"No spam. No vendor fluff. Unsubscribe any time."))))}},8963:function(e,t,n){n.d(t,{A:function(){return l}});var a=n(6540);function l({title:e,subtitle:t,primaryLink:n,primaryText:l,secondaryLink:r,secondaryText:s,backgroundImage:i}){const c=i?{backgroundImage:`linear-gradient(135deg, rgba(37, 99, 235, 0.85) 0%, rgba(13, 33, 55, 0.9) 100%), url(${i})`,backgroundSize:"cover",backgroundPosition:"center"}:{};return a.createElement("section",{className:"hero blueprint-section-subtle",style:c},a.createElement("div",{className:"container"},a.createElement("h1",null,e),t&&a.createElement("p",null,t),(n||r)&&a.createElement("div",{style:{display:"flex",gap:"var(--space-md)",flexWrap:"wrap"}},n&&a.createElement("a",{href:n,className:"btn btn-primary"},l||"Get Started"),r&&a.createElement("a",{href:r,className:"btn btn-outline"},s||"Learn More"))))}}}]);
2//# sourceMappingURL=component---src-components-page-template-jsx-content-file-path-content-posts-hunting-sensitive-data-mdx-8cb81b6d6a3ccecfe268.js.map