# Data Infiltration

**ID**: S1002

**Description**: An employee is suspected of taking confidential information or trade secrets from a prior employer and introducing it to internal systems.

## Are any ExternalCompany-related files on the actor's assigned Company assets? <span class="dfiqIdTag">F1001</span>
An actor may bring unauthorized external intellectual property onto Company "end user" devices (like laptops or desktops). Depending on the time frame under consideration, past devices that the actor no longer actively uses may need to be examined as well.

 - <span class="dfiqIdTag">Q1005</span> &nbsp;What files have ever been on a computer?
 - <span class="dfiqIdTag">Q1006</span> &nbsp;What files are present on a computer?
 - <span class="dfiqIdTag">Q1014</span> &nbsp;What files did the actor open on their computer?
 - <span class="dfiqIdTag">Q1027</span> &nbsp;Are there any sudden changes in the number of files on a device?
## Has the actor introduced any ExternalCompany files to Company assets via downloading? <span class="dfiqIdTag">F1002</span>

 - <a href="/questions/Q1001"><span class="dfiqIdTag">Q1001</span> &nbsp;What files were downloaded using a web browser?</a>
 - <span class="dfiqIdTag">Q1008</span> &nbsp;What programs are installed on a computer?
 - <span class="dfiqIdTag">Q1009</span> &nbsp;What interactions with external cloud storage sites did the actor have using their web browser?
 - <span class="dfiqIdTag">Q1015</span> &nbsp;What syncing activities did external "cloud storage" applications do on a computer?
 - <span class="dfiqIdTag">Q1025</span> &nbsp;What external accounts has the actor used in their web browser?
 - <span class="dfiqIdTag">Q1026</span> &nbsp;What files were downloaded from messaging apps?
 - <span class="dfiqIdTag">Q1031</span> &nbsp;How much network traffic was there to/from a machine?
## Has the actor introduced any ExternalCompany files to Company assets via removable storage devices? <span class="dfiqIdTag">F1003</span>

 - <span class="dfiqIdTag">Q1002</span> &nbsp;What USB devices were attached to a computer?
 - <span class="dfiqIdTag">Q1012</span> &nbsp;What files were copied from a USB device to a computer?
 - <span class="dfiqIdTag">Q1013</span> &nbsp;What files are present on a USB device?
## Are there any indications of communication with ExternalCompany? <span class="dfiqIdTag">F1029</span>
An actor may be exchanging information with an external company, commonly via websites or email messages. The following Questions are broad, and the results will need to be filtered for terms related to the external company.

 - <a href="/questions/Q1020"><span class="dfiqIdTag">Q1020</span> &nbsp;What pages did web browsers visit?</a>
 - <span class="dfiqIdTag">Q1084</span> &nbsp;What data was uploaded to a website via a web browser?
 - <span class="dfiqIdTag">Q1085</span> &nbsp;What DNS requests have been made from a system?
 - <span class="dfiqIdTag">Q1086</span> &nbsp;What web-based email messages were viewed in a web browser?
## Has the actor connected to any ExternalCompany systems? <span class="dfiqIdTag">F1030</span>
An actor may be connecting to services or systems associated with ExternalCompany, possibly through a client, a terminal, or a web browser.

 - <span class="dfiqIdTag">Q1087</span> &nbsp;Did the user access any common PaaS/SaaS services?
 - <span class="dfiqIdTag">Q1088</span> &nbsp;Did the user connect to any non-Company systems using the command line?
 - <span class="dfiqIdTag">Q1089</span> &nbsp;Did the user download any Citrix configuration (.ica) files?
 - <span class="dfiqIdTag">Q1090</span> &nbsp;Did the user interact with any git repositories?
