Skip to main content
Tier One
Medium

Backup service account uploads 40 GB to cloud storage

A-1052

00:00time on this alert, target 20 minutes

Back to queue

Alert details

Source
DLP
Detection rule
DLP-EXFIL-VOLUME-006
Affected user
svc-backup
Affected host
SRV-BACKUP-01
Source IP
—
First seen
2026-07-24T15:11:00Z

Why this fired, in plain English

An unusually large amount of data left the network in a short time.

Suggested playbook

Data exfiltration to external storage

  1. 1. Determine whether the destination account is corporate or personal.
  2. 2. Compare volume against the host's own baseline, not an absolute number.
  3. 3. Identify the process: a backup agent and a browser upload mean very different things.
  4. 4. Check the classification and how many files were involved.
Open the full checklist

Raw log evidence

Exactly what the tools recorded — 3 events.

  1. Guided hint: this line matters

    ts=2026-07-24T15:05:00Z host=SRV-BACKUP-01 src="dlp" event=upload dest_domain="blob.core.windows.net" account_type=corporate container="northwind-backup-prod" bytes_out=42949672960 result=allowed

    The destination is the company's own corporate cloud storage container.

  2. Guided hint: this line matters

    ts=2026-07-24T15:05:00Z host=SRV-BACKUP-01 EventID=4688 process_name="veeam.backup.agent.exe" parent_process="services.exe" user="svc-backup" cmdline="--job weekly-offsite --target northwind-backup-prod"

    A scheduled backup service, launched by the Windows service manager, not by a person.

  3. Guided hint: this line matters

    ts=2026-07-24T15:11:00Z src="siem" event=baseline_compare metric=bytes_out_daily host=SRV-BACKUP-01 today=42.9GB weekly_avg=41.2GB deviation=4%

    Compared with its own weekly average, this volume is completely normal.

Related events

The order things happened in.

  1. 15:05Z

    Weekly offsite backup job starts

  2. 15:11Z

    Volume rule triggers on total bytes

Enrichment lookups

Mock lookups. Run each one yourself — a real analyst never guesses what a lookup would have said. There is no "run everything" button on purpose.

0 of 3 lookups checked

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

techniques

Your verdict

Keyboard shortcuts 1–4, or click. You can always change your mind afterwards.