Search Closed Sources

Triage

1. Step 1: Identify the initiating process — examine InitiatingProcessFileName and InitiatingProcessCommandLine to determine whether a browser, script interpreter (python.exe, powershell.exe, node.exe), or API client generated the connection. Browser-initiated queries to data broker sites are lower risk than scripted bulk API calls.
2. Step 2: Check the user account's role — query HR/IAM systems or Active Directory to determine whether the account belongs to a sales, recruiting, marketing, or security team with a legitimate business reason to access commercial data broker platforms.
3. Step 3: Quantify query volume and velocity — review the aggregated QueryCount and UniqueURLs over the past 7 days. A sudden spike (e.g., 200+ queries in one session versus a typical baseline of 10/day) is a stronger indicator of bulk harvesting than steady low-volume access.
4. Step 4: For Tor or dark web proxy DNS resolution — immediately treat as high priority. Confirm whether the host is an authorized security research workstation. Check DeviceNetworkEvents for successful connections to Tor guard relays (port 9001, 9030, 9050) or known Tor IP ranges.
5. Step 5: Examine what data was queried — if possible, review HTTP proxy or DLP logs for the specific search terms or API parameters sent to data broker endpoints. Queries containing employee PII, organizational charts, executive contact details, or technology stack information are higher concern.
6. Step 6: Correlate with recent authentication events — check AADSignInLogs for the account: any impossible travel, new device sign-ins, or MFA bypass events in the 72 hours preceding the data broker access could indicate account compromise rather than insider threat.
7. Step 7: Review process ancestry — check if the initiating process was spawned by an unusual parent (e.g., a browser spawned by an Office document macro, or a Python script launched from an email attachment directory) which would indicate malware-driven reconnaissance.

Containment

1. If Tor access is confirmed from a non-authorized host: isolate the endpoint immediately via Defender for Endpoint Live Response or network quarantine, and initiate full malware scan.
2. If bulk data broker querying is confirmed as unauthorized: disable the user account in Azure AD and revoke active sessions/tokens via 'Revoke-AzureADUserAllRefreshToken' to terminate any active API sessions.
3. If account compromise is suspected: force password reset, require re-enrollment of MFA, and review all OAuth application grants for the compromised account in Azure AD Enterprise Applications.
4. Block outbound DNS and HTTP/HTTPS to identified data broker domains at the web proxy or DNS firewall layer if bulk unauthorized harvesting is confirmed, pending investigation completion.
5. Preserve the endpoint forensic image before any remediation if insider threat is suspected, as legal proceedings may require chain-of-custody evidence.

Evidence Collection

1. Export full DeviceNetworkEvents for the affected device covering the 30-day period prior to detection, filtered to all external connections — capture RemoteUrl, RemoteIP, BytesSent, BytesReceived to assess data exfiltration volume.
2. Collect browser history artifacts from the endpoint: Chrome (C:\Users\<user>\AppData\Local\Google\Chrome\User Data\Default\History), Firefox (C:\Users\<user>\AppData\Roaming\Mozilla\Firefox\Profiles\*.default\places.sqlite), Edge (C:\Users\<user>\AppData\Local\Microsoft\Edge\User Data\Default\History).
3. Extract PowerShell ScriptBlock logs (Event ID 4104) and command history (%APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt) to identify any scripted API calls to data brokers.
4. Collect web proxy or Zscaler/Netskope logs for the user account covering the investigation window, including full URL paths and HTTP method (GET/POST) which may reveal specific API endpoints and search parameters used.
5. If API keys or credentials for data broker platforms are suspected to be stored on the endpoint, collect credential store artifacts: Windows Credential Manager (cmdkey /list), browser saved passwords export, and .env or config files in user home directories.
6. Capture memory dump of any suspicious process (e.g., Python or Node.js process making bulk API calls) using ProcDump for later analysis of in-memory API tokens or query parameters.
7. Export Azure AD audit logs (AuditLogs table) for the user account's OAuth application authorizations and delegated permission grants, which may reveal third-party apps authorized to access organizational data.

Escalation Criteria

• ! Escalate to Incident Response if Tor or dark web proxy access is confirmed from any non-authorized corporate endpoint, as this indicates either a compromised host or a deliberate attempt to obscure reconnaissance activity.
• ! Escalate to Insider Threat team if a user account with data access privileges (HR, finance, engineering) is found making bulk API queries to people-search or business intelligence platforms, particularly outside business hours.
• ! Escalate if the queried domains or API parameters contain references to the organization's own employees, executives, IP ranges, or technology stack — indicating the organization itself may be the reconnaissance target (self-reconnaissance by threat actor using a compromised internal account).
• ! Escalate if external threat intelligence feeds (e.g., CISA advisories, FS-ISAC alerts, vendor threat reports) indicate that organizational data has appeared in a criminal marketplace or closed threat intelligence feed, suggesting a prior breach enabling closed-source reconnaissance.
• ! Escalate if the process making data broker connections was spawned by a suspicious parent process chain involving Office applications, script interpreters, or processes executing from user-writable directories (AppData, Temp, Downloads).