Praetorian; Darin Smith, Cisco; ExtraHop; Gabriel Currie
Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service.
A defender who is monitoring for large transfers to outside the cloud environment through normal file transfers or over command and control channels may not be watching for data transfers to another account within the same cloud provider. Such transfers may utilize existing cloud provider APIs and the internal address space of the cloud provider to blend into normal traffic or avoid data transfers over external network interfaces.[1]
Adversaries may also use cloud-native mechanisms to share victim data with adversary-controlled cloud accounts, such as creating anonymous file sharing links or, in Azure, a shared access signature (SAS) URI.[2]
Incidents have been observed where adversaries have created backups of cloud instances and transferred them to separate accounts.[3]
Threat groups64th percentile · 56% of ATT&CK techniques have fewer threat groups attributed.
0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.
0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.
13
Detection rulesTop 19%
Detection rules81st percentile · 79% of ATT&CK techniques have fewer detection rules written.
Transfer Data to Cloud Account MITRE reference T1537
64th pctamong all ATT&CK techniques for number of groups
3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Transfer Data to Cloud Account detection strategy DET0573
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Cross-Platform Detection of Data Transfer to Cloud Account
Enterprise
3 platforms
AN1580 · IaaS
Detects snapshot sharing, backup exports, or data object transfers from victim-owned cloud accounts to other cloud identities within the same provider (e.g., AWS, Azure) using snapshot sharing, S3 bucket policy updates, or SAS URI generation.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
High volume internal-to-internal IP transfer or cross-account cloud transfer
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
CrossAccountIDList
List of external cloud accounts authorized for snapshot or bucket sharing
Region
Geographic region in which the sharing occurs (may impact logging availability)
VolumeSizeThresholdGB
Threshold to alert on snapshot size or object volume
TimeWindow
Temporal window between snapshot creation and external sharing
AN1581 · Office Suite
Detects user activity that shares or syncs files with external domains via link generation, OneDrive external sharing, or file transfer actions involving non-whitelisted partner tenants.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
ExternalDomainList
Known partner or adversarial cloud identities/domains
TimeWindow
Duration between file access and external sharing
SharingMethod
Type of link (anonymous, internal, organization-wide) to alert on
AN1582 · SaaS
Detects use of built-in SaaS sharing mechanisms to transfer ownership or share access of critical data to external tenants or untrusted users through API calls or link generation features.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
Configure appropriate data sharing restrictions in cloud services. For example, external sharing in Microsoft SharePoint and Google Drive can be turned off altogether, blocked for certain domains, or restricted to certain users.
The following analytic detects suspicious modifications to AWS AMI attributes, such as sharing an AMI with another AWS account or making it publicly accessible. (...)
The following analytic detects a series of AWS API calls related to EC2 snapshots within a short time window, indicating potential exfiltration via EC2 Snapshot modifications. (...)
The following analytic identifies potential AWS S3 exfiltration behavior by correlating multiple risk events related to Collection and Exfiltration techniques. (...)
Detects when a Microsoft Cloud App Security reported when a user or IP address uses an app that is not sanctioned to perform an activity that resembles an attempt to exfiltrate information from your organization.
The following analytic detects a high frequency of file copying or moving within network shares, which may indicate potential data sabotage or exfiltration attempts. (...)