MOVEit DMZ Audit

Event	Title	Channel	Sample	Rule
0	MOVEit file-transfer audit record	Application	N	Y

Event ID 0: MOVEit file-transfer audit record

Channel: Application

Description

Progress MOVEit DMZ / Transfer writes one Windows Application-log audit event per user file operation (upload or download). MOVEit registers no message-resource DLL for this source, so Windows renders the audit message as free text under EventID 0. Successful actions are logged at Information level and failures at Error level.

Fields #

Name	Description
`userdisplayname`	Display name of the MOVEit user performing the transfer.
`Username`	Login username of the account.
`IPAddress`	Source IP address of the client performing the transfer.
`FileID`	MOVEit internal file identifier.
`FileName`	Name of the file transferred.
`FolderID`	MOVEit internal folder identifier.
`FolderPath`	Path of the folder the file was transferred to or from.
`AgentBrand`	Client agent or protocol used for the transfer (for example web or an SFTP client).

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`EventLog`	eq	`Application`	2 rules	kusto
`RenderedDescription`	contains	`downloaded`	2 rules	kusto
`RenderedDescription`	contains	`uploaded`	2 rules	kusto

Community Notes #

Third-party product event (Progress MOVEit DMZ / Transfer). Consumed by the Sentinel analytic rules 'MOVEit File Transfer Above Threshold' and 'MOVEit File Transfer Folders Above Threshold', which parse RenderedDescription for 'Downloaded' or 'Uploaded' and flag anomalous transfer volume (a data-exfiltration pattern surfaced by the 2023 MOVEit Transfer mass-exploitation campaign). Disambiguated from other EventID 0 Application events by Source 'MOVEit DMZ Audit'. Grounding is vendor documentation.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto # view in coverage

Progress MOVEIt File transfer above threshold source medium: Identifies Progress MOVEIt File Transfers above certain threshold in a 15min time period. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.T1020
Progress MOVEIt File transfer folder count above threshold source medium: Identifies Progress MOVEIt File Transfers with distinct folder count above certain threshold in a 15min time period. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.T1020