Application-based file exfiltration detection

A computing device for detecting file exfiltration, the device comprising:

• one or more processors;
• a memory, storing instructions, which when executed by the one or more processors, cause the one or more processors to perform operations of an application, the operations of the application comprising:
• identifying a file system element event corresponding to a file system element via an operating system;
• determining that the file system element event corresponds to a web-browser application, the web-browser application a separate application from the application;
• responsive to determining that the file system element event corresponds to the web-browser application:
• determining a website visited by the web-browser application corresponding to the file system element event;
• identifying that the website visited by the web-browser application is a network-based file storage or sharing service;
• identifying an account used to access the network-based file storage or sharing service;
• determining that the account used to access the network-based file storage or sharing service is not an account of an organization associated with the file system element;
• determining to send an alert to an administrative computing device based upon the identifying that the website visited by the web-browser application is the network-based file storage or sharing service and based upon determining that the account used to access the network-based file storage or sharing service is a personal account;
• and
• responsive to determining that an alert is to be sent, sending the alert to the administrative computing device, the alert indicating that the file system element event that is characteristic of an unauthorized file exfiltration has been detected.

A non-transitory machine-readable medium, storing instructions for detecting file exfiltration, the instructions, which when executed by a computing device, causes the computing device to perform operations comprising:

• identifying a file system element event corresponding to a file system element via an operating system;
• determining that the file system element event corresponds to a web-browser application, the web-browser application a separate application from the application;
• responsive to determining that the file system element event corresponds to the web-browser application:
• determining a website visited by the web-browser application corresponding to the file system element event;
• identifying that the website visited by the web-browser application is a network-based file storage or sharing service;
• identifying an account used to access the network-based file storage or sharing service;
• determining that the account used to access the network-based file storage or sharing service is not an account of an organization associated with the file system element;
• determining to send an alert to an administrative computing device based upon the identifying that the website visited by the web-browser application is the network-based file storage or sharing service and based upon determining that the account used to access the network-based file storage or sharing service is a personal account;
• and
• responsive to determining that an alert is to be sent, sending the alert to the administrative computing device, the alert indicating that the file system element event that is characteristic of an unauthorized file exfiltration has been detected.