<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-data-hoarding
description: >-
  Detect and remediate excessive data accumulation by users and service accounts
  that violates data minimization principles, increases breach blast radius, and
  creates compliance risk under GDPR Article 5(1)(c) and similar mandates.
domain: cybersecurity
subdomain: data-security
tags:
  - data-hoarding
  - data-minimization
  - gdpr
  - insider-threat
  - data-governance
  - storage-analysis
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1074"]
---

# Detecting Data Hoarding

## Overview

Detect and remediate excessive data accumulation by users and service accounts
that violates data minimization principles, increases breach blast radius, and
creates compliance risk under GDPR Article 5(1)(c) and similar mandates.

Mode: `[MODE: BLUE]` — Detecting Data Hoarding.

## Prerequisites

| Requirement | Details |
|---|---|
| Refer to technique-specific requirements in the workflow section | Required |
| Data classification taxonomy with sensitivity levels | Required |
| Appropriate platform access for target environment | Required |
| Log aggregation and SIEM integration | Required |
| Change management process for policy deployment | Required |

## Key Concepts

Refer to the CLI commands and workflow sections for detailed implementation guidance.

### CLI Commands

```bash
node scripts/agent.js --action analyze --input /tmp/input.json \
  --output /tmp/output.json

node scripts/agent.js --action stale --input /tmp/input.json \
  --output /tmp/output.json

node scripts/agent.js --action baseline --input /tmp/input.json \
  --output /tmp/output.json
```

## Workflow

### Step 1: Prepare Input Data

Gather and format input data for the target action.

### Step 2: Execute Analysis

```bash
node scripts/agent.js --action analyze --input /tmp/input.json \
  --output /tmp/output.json
```

### Step 3: Review Findings

Analyze output for gaps, violations, or anomalies.

### Step 4: Remediate

Address identified issues according to severity.

### Step 5: Monitor

Deploy continuous monitoring for ongoing compliance.

## Detection

```yaml
title: Data Hoarding Detection
id: 64b30e69-3bc4-44a0-8a76-2e486c39da1d
status: experimental
description: Detects suspicious activity related to detecting data hoarding techniques in data security context
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename: "*suspicious*"
  condition: selection
level: medium
tags:
  - attack.t1074
  - attack.exfiltration
falsepositives:
  - Data loss prevention tools scanning files during classification
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Data Hoarding Detection | windows/file_access | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1074 |

## Verification

- [ ] All target assets inventoried and analyzed
- [ ] Policy violations identified and documented
- [ ] Remediation actions tracked to completion
- [ ] Continuous monitoring alerts configured
- [ ] Compliance evidence archived for audit
- [ ] Periodic review schedule established
- [ ] Findings reported to stakeholders

## References

- [NIST SP 800-53 — Security and Privacy Controls](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)
- [CIS Controls](https://www.cisecurity.org/controls)
- [MITRE ATT&CK](https://attack.mitre.org/)
- [GDPR](https://gdpr-info.eu/)
