tfMITRE ATT&CK technique

Data from Cloud Storage T1530

Tactic: Collection
Platforms: IaaS, Office Suite, SaaS
Version: 2.2
Created: 30 August 2019
Last modified: 12 May 2026
Contributors: Netskope; Praetorian; AppOmni; Arun Seelagan, CISA

Adversaries may access data from cloud storage.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 25%

Threat groups75th percentile · 75% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 17%

Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware62nd pct

Tools & malware62nd percentile · 62% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules74th pct

Detection rules74th percentile · 74% of ATT&CK techniques have this many detection rules written or fewer.

Data from Cloud Storage MITRE reference T1530

Top 25%of all ATT&CK techniques for number of groups

6 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

ShinyHuntersG1057 ↗

Has collected data from insecure cloud buckets.1

created 2026-07-291 referenceaka UNC6240

Storm-0501G1053 ↗

Had modified Azure Storage account resources through the Microsoft.Storage/storageAccounts/write operation to expose non-remotely accessible accounts for data exfiltration.1

created 2025-10-191 reference

APT42G1044 ↗

Has collected data from Microsoft 365 environments.1 2

created 2025-01-082 references

Scattered SpiderG1015 ↗

Enumerates data stored in cloud resources for collection and exfiltration purposes.1

created 2023-07-051 referenceaka Roasted 0ktapus

HAFNIUMG0125 ↗

Has exfitrated data from OneDrive.1

created 2021-03-031 referenceaka Operation Exchange Marauder

Fox KittenG0117 ↗

Has obtained files from the victim's cloud storage instances.1

created 2020-12-211 referenceaka UNC757

All 6 groups for this technique

Offense vs defense T1530

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 2Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 10

first rule: 2020 Q2 · 2 of 2 campaigns plotted

Data from Cloud Storage detection strategy DET0484

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Multi-Platform Cloud Storage Exfiltration Behavior Chain

Enterprise

3 platforms

AN1328 · IaaS

Spike in object access from new IAM user or role followed by data exfiltration to external IPs

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account MetadataDC0013	AWS:CloudTrail	AssumeRole
Cloud Storage AccessDC0025	AWS:CloudTrail	GetObject, CopyObject
Network Traffic ContentDC0085	AWS:VPCFlowLogs	Unusual volume of data transferred from S3 storage endpoints to non-corporate IPs

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Timeframe for data transfer correlation (e.g., 10 minutes)
ExternalIPAllowList	Known list of corporate and expected outbound IP addresses

AN1329 · SaaS

OAuth token granted to external app followed by download of high-volume files in OneDrive/Google Drive

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Cloud Storage AccessDC0025	m365:unified	FileAccessed, FileDownloaded, ConsentGranted

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AppRegistrationNamePattern	Pattern of suspicious OAuth app names (e.g., `rclone`, `mega`, `backup*`)
DownloadThresholdMB	Flag file downloads over X MB (e.g., >100MB) within short intervals

AN1330 · Office Suite

Internal user account accesses shared links outside org followed by mass file download

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account AuthenticationDC0002	azure:signinlogs	SigninSuccess
Cloud Storage AccessDC0025	m365:sharepoint	AnonymousLinkCreated, FileDownloaded

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
LinkVisibilityScope	Whether links allow anonymous/external access
DownloadBurstThreshold	# of files downloaded within <5 mins (e.g., >50 files)

Tests2Executorssh 1 · PowerShell 1Need elevation0 of 2Have prerequisites2Have cleanup2Platformsiaas:aws, iaas:azure

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

AWS - Scan for Anonymous Access to S3

iaas:aws

—

Yes

Upon successful execution, this test will test for anonymous access to AWS S3 buckets and dumps all the files to a local folder.

Input arguments

Name	Type	Default	Description
s3_bucket_name	string	redatomic-test2	Name of the bucket

Attack command

aws --no-sign-request s3 cp --recursive s3://#{s3_bucket_name} /tmp/#{s3_bucket_name}

Cleanup command

aws s3 rb s3://#{s3_bucket_name} --force 
rm -rf /tmp/#{s3_bucket_name}

Prerequisite

Check if ~/.aws/credentials file has a default stanza is configured

Check

cat ~/.aws/credentials | grep "default"
aws s3api create-bucket --bucket #{s3_bucket_name}
aws s3api put-bucket-policy --bucket #{s3_bucket_name} --policy file://$PathToAtomicsFolder/T1530/src/policy.json
touch /tmp/T1530.txt
aws s3 cp /tmp/T1530.txt s3://#{s3_bucket_name}

Satisfy

echo Please install the aws-cli and configure your AWS default profile using: aws configure

GUID3e685a1c-61e0-430b-a045-ff1fec45f909

Azure - Dump Azure Storage Account Objects via Azure CLI

iaas:azure

PowerShell

—

Yes

This test dumps the content of the storage account objects present in the file defined in file_shares_csv_file_path. Note that this file is created in the atomic test T1619 "Azure - Enumerate Storage Account Objects via Key-based authentication using Azure CLI". When created manually, it must contain the columns "ResourceGroup","StorageAccountName", "FileShareName", "ContainerName", "BlobName". Requirements: - The test is intended to be executed in interactive mode (with -Interactive parameter) in order to complete the az login command when MFA is required. - The EntraID user must have the role "Storage Account Contributor", or a role with similar permissions.

Input arguments

Name	Type	Default	Description
output_folder	path	$env:temp\T1530_storage_account_objects	Folder path to output file share content to
storage_account_objects_csv_file_path	path	$env:temp\T1619_storage_account_objects.csv	Path to file that contains all storage account objects in form of a csv file. This may be the result from Test T1619 "Azure - Enumerate Storage Account Objects via Key-based authentication using Azure CLI".

Attack command

$storage_account_objects = Import-Csv -Path "#{storage_account_objects_csv_file_path}"

# Login to Azure
az login

if (-not (Test-Path -Path "#{output_folder}")) {
    New-Item -ItemType Directory -Path "#{output_folder}"
}

foreach ($row in $storage_account_objects) {
    
    if ($row.FileShareName -ne ""){
        $allowSharedKeyAccess = az storage account show --name $row.StorageAccountName --resource-group $row.ResourceGroup --query "allowSharedKeyAccess"

        if ($allowSharedKeyAccess -eq "false") {    # $allowSharedKeyAccess could be true or null
            Write-Output "Shared key access is disabled for this storage account."
        } else {
            Write-Output "Fetching content from file share: $($row.FileShareName) in storage account $($row.StorageAccountName) ..."
            $connectionString = az storage account show-connection-string --name $row.StorageAccountName --resource-group $row.ResourceGroup --query connectionString --output tsv
            
            # Create folder for storage account objects
            $storageAccountOutputPath = Join-Path #{output_folder} "$($row.ResourceGroup)_$($row.StorageAccountName)"
            if (-not (Test-Path -Path $storageAccountOutputPath)) {
                New-Item -ItemType Directory -Path $storageAccountOutputPath
            }

            # create folder for file share content
            $fileSharePath = Join-Path -Path $storageAccountOutputPath $row.FileShareName
            if (-not (Test-Path -Path $fileSharePath)) {
                New-Item -ItemType Directory -Path $fileSharePath
            }
            az storage file download-batch --connection-string $connectionString --source $row.FileShareName --destination $fileSharePath
        }
    } elseif ($row.ContainerName -ne "" -and $row.BlobName -eq "") {
        $allowSharedKeyAccess = az storage account show --name $row.StorageAccountName --resource-group $row.ResourceGroup --query "allowSharedKeyAccess"

        if ($allowSharedKeyAccess -eq "false") {    # $allowSharedKeyAccess could be true or null
            Write-Output "Shared key access is disabled for this storage account."
        } else {
            Write-Output "Fetching all blobs from container $($row.ContainerName) in storage account $($row.StorageAccountName) ..."
            $connectionString = az storage account show-connection-string --name $row.StorageAccountName --resource-group $row.ResourceGroup --query connectionString --output tsv
            
            # Create folder for storage account objects
            $storageAccountOutputPath = Join-Path #{output_folder} "$($row.ResourceGroup)_$($row.StorageAccountName)"
            if (-not (Test-Path -Path $storageAccountOutputPath)) {
                New-Item -ItemType Directory -Path $storageAccountOutputPath
            }

            # create folder for blob content
            $containerFolderPath = Join-Path $storageAccountOutputPath $row.ContainerName
            if (-not (Test-Path -Path $containerFolderPath)) {
                New-Item -ItemType Directory -Path $containerFolderPath
            }
            az storage blob download-batch --destination $containerFolderPath --source $row.ContainerName --connection-string $connectionString
        }
    }
}

Cleanup command

Remove-Item -Path "#{output_folder}" -Recurse -Force -erroraction silentlycontinue
Write-Output "Removed #{output_folder}"

Prerequisite

Azure CLI must be installed

Check

try {if (Get-InstalledModule -Name Az -ErrorAction SilentlyContinue) {exit 0} else {exit 1}} catch {exit 1}

Satisfy

Install-Module -Name Az -Force

GUIDcfaeaa92-4592-45a6-a27d-adf0baeee971

Tests from Atomic Red Team (MIT licence) · technique definition

Data from Cloud Storage detections T1530

10 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

74th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs