Storm-0501G1053 ↗
Has copied data from the victims environment to their own infrastructure leveraging AzCopy CLI.1
tfMITRE ATT&CK technique
Transfer Data to Cloud Account T1537
- Tactic
- Exfiltration
- Platforms
- IaaS, Office Suite, SaaS
- Version
- 1.5
- Created
- 30 August 2019
- Last modified
- 24 October 2025
- Contributors
- Praetorian; Darin Smith, Cisco; ExtraHop; Gabriel Currie
Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
3
Threat groups64th pct
Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.13
Detection rulesTop 19%
Detection rules81st percentile · 81% of ATT&CK techniques have this many detection rules written or fewer.Transfer Data to Cloud Account MITRE reference T1537
64th pctamong all ATT&CK techniques for number of groups
3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
RedCurlG1039 ↗
Has used cloud storage to exfiltrate data, in particular the megatools utilities were used to exfiltrate data to Mega, a file storage service.12
INC RansomG1032 ↗
Has used Megasync to exfiltrate data to the cloud.1
All 3 groups for this technique
Offense vs defense T1537
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 6Splunk ESCU (cumulative) · 7
first rule: 2020 Q2Transfer Data to Cloud Account detection strategy DET0573
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Cross-Platform Detection of Data Transfer to Cloud Account
3 platforms
AN1580 · IaaS
Detects snapshot sharing, backup exports, or data object transfers from victim-owned cloud accounts to other cloud identities within the same provider (e.g., AWS, Azure) using snapshot sharing, S3 bucket policy updates, or SAS URI generation.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Cloud Storage ModificationDC0023 | AWS:CloudTrail | PutBucketPolicy |
| Snapshot CreationDC0057 | AWS:CloudTrail | CreateSnapshot |
| Snapshot ModificationDC0058 | AWS:CloudTrail | ModifySnapshotAttribute |
| Snapshot MetadataDC0062 | AWS:CloudTrail | CopySnapshot |
| Network Traffic ContentDC0085 | AWS:VPCFlowLogs | High volume internal-to-internal IP transfer or cross-account cloud transfer |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CrossAccountIDList | List of external cloud accounts authorized for snapshot or bucket sharing |
| Region | Geographic region in which the sharing occurs (may impact logging availability) |
| VolumeSizeThresholdGB | Threshold to alert on snapshot size or object volume |
| TimeWindow | Temporal window between snapshot creation and external sharing |
AN1581 · Office Suite
Detects user activity that shares or syncs files with external domains via link generation, OneDrive external sharing, or file transfer actions involving non-whitelisted partner tenants.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Cloud Storage ModificationDC0023 | m365:unified | SharingSet |
| Cloud Storage MetadataDC0027 | m365:unified | AnonymousLinkCreated |
| Application Log ContentDC0038 | m365:unified | FileAccessed |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ExternalDomainList | Known partner or adversarial cloud identities/domains |
| TimeWindow | Duration between file access and external sharing |
| SharingMethod | Type of link (anonymous, internal, organization-wide) to alert on |
AN1582 · SaaS
Detects use of built-in SaaS sharing mechanisms to transfer ownership or share access of critical data to external tenants or untrusted users through API calls or link generation features.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Cloud Storage ModificationDC0023 | saas:googledrive | drive.permission.add |
| Cloud Storage MetadataDC0027 | saas:box | collaboration.invite |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| UserContext | Whether the user is in a high-privileged or VIP group |
| DomainReputationList | Allowlist or blocklist of external SaaS domains |
| PayloadVolumeThreshold | Size or number of shared files triggering alert |
Data Loss PreventionM1057
Data loss prevention can prevent and block sensitive data from being shared with individuals outside an organization.
Implement network-based filtering restrictions to prohibit data transfers to untrusted VPCs.
Configure appropriate data sharing restrictions in cloud services. For example, external sharing in Microsoft SharePoint and Google Drive can be turned off altogether, blocked for certain domains, or restricted to certain users.
Limit user account and IAM policies to the least privileges required.