<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-unauthorized-data-replication
description: >-
  Detect unauthorized data replication including shadow database copies, unsanctioned
  cloud sync, cross-region replication violations, and rogue ETL pipelines that
  create uncontrolled copies of sensitive data outside governance boundaries.
domain: cybersecurity
subdomain: data-security
tags:
  - data-replication
  - shadow-data
  - data-sprawl
  - cloud-sync
  - etl-monitoring
  - governance
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1020"]
---

# Detecting Unauthorized Data Replication

## Overview

Detect unauthorized data replication including shadow database copies, unsanctioned
cloud sync, cross-region replication violations, and rogue ETL pipelines that
create uncontrolled copies of sensitive data outside governance boundaries.

Mode: `[MODE: BLUE]` — Detecting Unauthorized Data Replication.

## Prerequisites

| Requirement | Details |
|---|---|
| Refer to technique-specific requirements in the workflow section | Required |
| Data classification taxonomy with sensitivity levels | Required |
| Appropriate platform access for target environment | Required |
| Log aggregation and SIEM integration | Required |
| Change management process for policy deployment | Required |

## Key Concepts

Refer to the CLI commands and workflow sections for detailed implementation guidance.

### CLI Commands

```bash
node scripts/agent.js --action detect --input /tmp/input.json \
  --output /tmp/output.json

node scripts/agent.js --action cloud-audit --input /tmp/input.json \
  --output /tmp/output.json

node scripts/agent.js --action fingerprint --input /tmp/input.json \
  --output /tmp/output.json
```

## Workflow

### Step 1: Prepare Input Data

Gather and format input data for the target action.

### Step 2: Execute Analysis

```bash
node scripts/agent.js --action detect --input /tmp/input.json \
  --output /tmp/output.json
```

### Step 3: Review Findings

Analyze output for gaps, violations, or anomalies.

### Step 4: Remediate

Address identified issues according to severity.

### Step 5: Monitor

Deploy continuous monitoring for ongoing compliance.

## Detection

```yaml
title: Unauthorized Data Replication Detection
id: 480d80b2-9458-4183-985f-5426eed73319
status: experimental
description: Detects suspicious activity related to detecting unauthorized data replication techniques in data security context
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename: "*suspicious*"
  condition: selection
level: medium
tags:
  - attack.t1020
  - attack.exfiltration
falsepositives:
  - Data loss prevention tools scanning files during classification
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Unauthorized Data Replication Detection | windows/file_access | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1020 |

## Verification

- [ ] All target assets inventoried and analyzed
- [ ] Policy violations identified and documented
- [ ] Remediation actions tracked to completion
- [ ] Continuous monitoring alerts configured
- [ ] Compliance evidence archived for audit
- [ ] Periodic review schedule established
- [ ] Findings reported to stakeholders

## References

- [NIST SP 800-53 — Security and Privacy Controls](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)
- [CIS Controls](https://www.cisecurity.org/controls)
- [MITRE ATT&CK](https://attack.mitre.org/)
- [GDPR](https://gdpr-info.eu/)
