{
  "model_id": "SOC.074",
  "name": "Document Harvesting",
  "description": "find command searching for documents (*.pdf, *.docx, *.xlsx) — data collection before exfil.",
  "threshold": 0.6,
  "evaluations": [
    {
      "name": "Find",
      "type": "comparison",
      "left": "event.raw.comm",
      "operator": "==",
      "right": "find",
      "weight": 3
    },
    {
      "name": "Docs",
      "type": "comparison",
      "left": "event.raw.cmdline",
      "operator": "LIKE",
      "right": "%.pdf%",
      "weight": 3
    },
    {
      "name": "OrDocs",
      "type": "logical",
      "operator": "OR",
      "operands": [
        "Docs",
        "Docx",
        "Xlsx"
      ],
      "weight": 4
    },
    {
      "name": "Logic",
      "type": "logical",
      "operator": "AND",
      "operands": [
        "Find",
        "OrDocs"
      ],
      "weight": 4
    },
    {
      "name": "Docx",
      "type": "comparison",
      "left": "event.raw.cmdline",
      "operator": "LIKE",
      "right": "%.docx%",
      "weight": 3
    },
    {
      "name": "Xlsx",
      "type": "comparison",
      "left": "event.raw.cmdline",
      "operator": "LIKE",
      "right": "%.xlsx%",
      "weight": 3
    }
  ],
  "actions": [
    {
      "type": "emit_alert",
      "reason": "Document harvesting — find for .pdf/.docx/.xlsx."
    }
  ],
  "mitre_tactics": [
    "Collection"
  ],
  "mitre_techniques": [
    "T1005",
    "T1119"
  ],
  "severity": "medium",
  "observables": [
    "event.actor.user"
  ]
}