{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1530","id":"T1530","name":"Data from Cloud Storage","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1530","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"e4d67f1cb6642188756618ac55f0dbd6e57c7e23bc63289373d2527fb0ab143e","description":"Adversaries may access data from cloud storage.\n\nMany IaaS providers offer solutions for online data object storage such as Amazon S3, Azure Storage, and Google Cloud Storage. Similarly, SaaS enterprise platforms such as Office 365 and Google Workspace provide cloud-based document storage to users through services such as OneDrive and Google Drive, while SaaS application providers such as Slack, Confluence, Salesforce, and Dropbox may provide cloud storage solutions as a peripheral or primary use case of their platform. \n\nIn some cases, as with IaaS-based cloud storage, there exists no overarching application (such as SQL or Elasticsearch) with which to interact with the stored objects: instead, data from these solutions is retrieved directly though the [Cloud API](https://attack.mitre.org/techniques/T1059/009). In SaaS applications, adversaries may be able to collect this data directly from APIs or backend cloud storage objects, rather than through their front-end application or interface (i.e., [Data from Information Repositories](https://attack.mitre.org/techniques/T1213)). \n\nAdversaries may collect sensitive data from these cloud storage solutions. Providers typically offer security guides to help end users configure systems, though misconfigurations are a common problem.(Citation: Amazon S3 Security, 2019)(Citation: Microsoft Azure Storage Security, 2019)(Citation: Google Cloud Storage Best Practices, 2019) There have been numerous incidents where cloud storage has been improperly secured, typically by unintentionally allowing public access to unauthenticated users, overly-broad access by all users, or even access for any anonymous person outside the control of the Identity Access Management system without even needing basic user permissions.\n\nThis open access may expose various types of sensitive data, such as credit cards, personally identifiable information, or medical records.(Citation: Trend Micro S3 Exposed PII, 2017)(Citation: Wired Magecart S3 Buckets, 2019)(Citation: HIPAA Journal S3 Breach, 2017)(Citation: Rclone-mega-extortion_05_2021)\n\nAdversaries may also obtain then abuse leaked credentials from source repositories, logs, or other means as a way to gain access to cloud storage objects.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1530","external_id":"T1530"},{"source_name":"Amazon S3 Security, 2019","description":"Amazon. (2019, May 17). How can I secure the files in my Amazon S3 bucket?. Retrieved October 4, 2019.","url":"https://aws.amazon.com/premiumsupport/knowledge-center/secure-s3-resources/"},{"source_name":"Microsoft Azure Storage Security, 2019","description":"Amlekar, M., Brooks, C., Claman, L., et. al.. (2019, March 20). Azure Storage security guide. Retrieved October 4, 2019.","url":"https://docs.microsoft.com/en-us/azure/storage/common/storage-security-guide"},{"source_name":"Wired Magecart S3 Buckets, 2019","description":"Barrett, B.. (2019, July 11). Hack Brief: A Card-Skimming Hacker Group Hit 17K Domains—and Counting. Retrieved October 4, 2019.","url":"https://www.wired.com/story/magecart-amazon-cloud-hacks/"},{"source_name":"Google Cloud Storage Best Practices, 2019","description":"Google. (2019, September 16). Best practices for Cloud Storage. Retrieved October 4, 2019.","url":"https://cloud.google.com/storage/docs/best-practices"},{"source_name":"HIPAA Journal S3 Breach, 2017","description":"HIPAA Journal. (2017, October 11). 47GB of Medical Records and Test Results Found in Unsecured Amazon S3 Bucket. Retrieved October 4, 2019.","url":"https://www.hipaajournal.com/47gb-medical-records-unsecured-amazon-s3-bucket/"},{"source_name":"Rclone-mega-extortion_05_2021","description":"Justin Schoenfeld, Aaron Didier. (2021, May 4). Transferring leverage in a ransomware attack. Retrieved July 14, 2022.","url":"https://redcanary.com/blog/rclone-mega-extortion/"},{"source_name":"Trend Micro S3 Exposed PII, 2017","description":"Trend Micro. (2017, November 6). A Misconfigured Amazon S3 Exposed Almost 50 Thousand PII in Australia. Retrieved October 4, 2019.","url":"https://www.trendmicro.com/vinfo/us/security/news/virtualization-and-cloud/a-misconfigured-amazon-s3-exposed-almost-50-thousand-pii-in-australia"}],"platforms":["IaaS","Office Suite","SaaS"],"environments":["cloud","onprem","saas"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0025","name":"Cloud Storage Access","page":"telemetry/DC0025/","kind":"attack_component","category":"Cloud storage","description":"Access to stored cloud data, including reads and provider-supported access outcomes.","collection_focus":"Explicitly select relevant object-read data events; keep principal, key, request ID and result without object contents.","providers":[{"name":"AWS CloudTrail for S3","scope":"Bucket control-plane events and explicitly selected object data events.","source_id":"data_events"},{"name":"Google Cloud Audit Logs","scope":"Cloud Storage access requires the relevant audit category and permissions.","source_id":"gcp"},{"name":"Azure storage resource logs","scope":"Use resource-specific data-plane diagnostics; Activity Log alone does not describe blob reads.","source_id":"azure_storage"}],"configuration":["Choose only the lab buckets/containers and prefixes. Enable read/write data-event collection when object access is needed; management events alone are insufficient.","Keep administrative changes separately from object reads/writes. Set a cost budget and retention limit before enabling high-volume data logging.","Preserve object version/key, requesting identity, action, source address, result and request ID. Verify the collector actually receives one benign read and one benign write."],"configuration_example":{"label":"CloudTrail advanced event selector · example S3 prefix","language":"json","source_id":"data_events","content":"[\n  {\n    \"Name\": \"LabObjectReads\",\n    \"FieldSelectors\": [\n      {\n        \"Field\": \"eventCategory\",\n        \"Equals\": [\n          \"Data\"\n        ]\n      },\n      {\n        \"Field\": \"resources.type\",\n        \"Equals\": [\n          \"AWS::S3::Object\"\n        ]\n      },\n      {\n        \"Field\": \"resources.ARN\",\n        \"StartsWith\": [\n          \"arn:aws:s3:::lab-bucket/demo/\"\n        ]\n      },\n      {\n        \"Field\": \"readOnly\",\n        \"Equals\": [\n          \"true\"\n        ]\n      }\n    ]\n  }\n]","note":"Replace the placeholder with an owned lab bucket/prefix. Review costs and merge with required selectors; applying selectors can replace an existing selection. This does not enable management-event retention or object-write coverage."},"required_fields":["action","bucket","key","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0025","collector":"illustrative-lab-collector","observation":{"action":"get_object","bucket":"lab-bucket","key":"demo.txt","actor":"lab-reader","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Storage metadata, listing, object access and bucket administration are different operations. Do not equate a successful request with proven exfiltration or complete content visibility.","sources":[{"id":"data_events","title":"AWS CloudTrail data-event selectors","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html"},{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"},{"id":"azure_storage","title":"Azure Blob Storage resource logging","url":"https://learn.microsoft.com/en-us/azure/storage/blobs/monitor-blob-storage"}],"association":"attack_component","anomaly_design":"Per principal and bucket/container: unusual object-read counts, transferred volume, new access pairs and bulk permission/deletion activity. Model backups, migrations and lifecycle policies separately."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0002","name":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component","category":"Identity and SaaS","description":"Authentication attempts and outcomes for a user or workload account.","collection_focus":"Collect successful and failed sign-ins, authentication method, application and conditional-access context; distinguish account validation from session creation.","providers":[{"name":"Microsoft Entra sign-in logs","scope":"Interactive, non-interactive and workload sign-in contexts, subject to tenant features and access.","source_id":"entra"},{"name":"Cloud identity service audit","scope":"Issuer-side credential and administrative events where the service supports them.","source_id":"cloudtrail"},{"name":"Application audit instrumentation","scope":"Application-side use of identities and sessions; design fields without raw tokens.","source_id":"otel"}],"configuration":["Enable/export the required identity sign-in and audit categories from the lab tenant to a protected destination. Document license, role and retention requirements.","Correlate issuance or administrative changes with later sign-ins using non-secret credential IDs, application IDs, user IDs and correlation IDs.","Exclude passwords, bearer tokens, cookies and private keys. Record success, failure, authentication context and application result separately."],"configuration_example":null,"required_fields":["account","application","result","reason","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A token creation record is not evidence of token use; a sign-in is not a complete record of every resource access. Some provider-side data is unavailable to the customer.","sources":[{"id":"entra","title":"Microsoft Entra sign-in logs","url":"https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins"},{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per identity and application: first-seen clients/resources, changes in authentication failures and session patterns, and unusual permission changes. Separate automation, travel, shared egress and identity-provider policy changes."},{"id":"DC0013","name":"User Account Metadata","page":"telemetry/DC0013/","kind":"attack_component","category":"Host state and inventory","description":"Account inventory and attributes at a point in time.","collection_focus":"Export an authorized directory/account inventory with stable IDs, roles, enabled state and collection time; compare snapshots without exposing credentials.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["account_id","enabled","roles","inventory_time"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0013","collector":"illustrative-lab-collector","observation":{"account_id":"user-lab-1","enabled":true,"roles":["lab-reader"],"inventory_time":"2026-09-27T12:00:00Z"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."}],"detection":{"key":"enterprise/T1530","id":"T1530","name":"Data from Cloud Storage","domain":"enterprise","platforms":["IaaS","Office Suite","SaaS"],"environments":["cloud","onprem","saas"],"source_url":"https://attack.mitre.org/techniques/T1530","technique_page":"techniques/enterprise/T1530/","page":"detections/enterprise/T1530/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[],"atlas_basic":[{"id":"atlas-basic-t1530-1","technique_id":"T1530","title":"T1530 Data from Cloud Storage","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#collection","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":156,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L156","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"9d968a52c02a3fcc810f8c3a00025a209279405dcbba42ecd0df7cad5c417e4f","validation":"published_concept_not_executable_or_live_validated","logic":"COUNT(object_read_or_list BY identity, 10m) >= threshold OR MATCH(snapshot_or_bucket_export) -> ALERT","log_sources":[{"title":"Cloud Object-Storage Access Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#108-cloud-object-storage-access-logs"},{"title":"Cloud Data-Plane Access Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#104-cloud-data-plane-access-logs"}]}],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0484","name":"Multi-Platform Cloud Storage Exfiltration Behavior Chain","url":"https://attack.mitre.org/detectionstrategies/DET0484","stix_id":"x-mitre-detection-strategy--1177cbb7-bc00-4a36-8774-d51b7b3c66e9","relationship_id":"relationship--5a06a041-1cfe-4276-ba47-de008a6f56a3","description":"","analytics":[{"id":"AN1328","name":"Analytic 1328","guidance":"Spike in object access from new IAM user or role followed by data exfiltration to external IPs","url":"https://attack.mitre.org/detectionstrategies/DET0484#AN1328","platforms":["IaaS"],"tuning":[{"field":"TimeWindow","description":"Timeframe for data transfer correlation (e.g., 10 minutes)"},{"field":"ExternalIPAllowList","description":"Known list of corporate and expected outbound IP addresses"}],"log_sources":[{"component_id":"DC0025","component":"Cloud Storage Access","name":"AWS:CloudTrail","channel":"GetObject, CopyObject","platforms":["IaaS"],"analytic_id":"AN1328","source_url":"https://attack.mitre.org/detectionstrategies/DET0484#AN1328","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0025/"},{"component_id":"DC0013","component":"User Account Metadata","name":"AWS:CloudTrail","channel":"AssumeRole","platforms":["IaaS"],"analytic_id":"AN1328","source_url":"https://attack.mitre.org/detectionstrategies/DET0484#AN1328","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0013/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"AWS:VPCFlowLogs","channel":"Unusual volume of data transferred from S3 storage endpoints to non-corporate IPs","platforms":["IaaS"],"analytic_id":"AN1328","source_url":"https://attack.mitre.org/detectionstrategies/DET0484#AN1328","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]},{"id":"AN1329","name":"Analytic 1329","guidance":"OAuth token granted to external app followed by download of high-volume files in OneDrive/Google Drive","url":"https://attack.mitre.org/detectionstrategies/DET0484#AN1329","platforms":["SaaS"],"tuning":[{"field":"AppRegistrationNamePattern","description":"Pattern of suspicious OAuth app names (e.g., `rclone`, `mega`, `backup*`)"},{"field":"DownloadThresholdMB","description":"Flag file downloads over X MB (e.g., >100MB) within short intervals"}],"log_sources":[{"component_id":"DC0025","component":"Cloud Storage Access","name":"m365:unified","channel":"FileAccessed, FileDownloaded, ConsentGranted","platforms":["SaaS"],"analytic_id":"AN1329","source_url":"https://attack.mitre.org/detectionstrategies/DET0484#AN1329","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0025/"}]},{"id":"AN1330","name":"Analytic 1330","guidance":"Internal user account accesses shared links outside org followed by mass file download","url":"https://attack.mitre.org/detectionstrategies/DET0484#AN1330","platforms":["Office Suite"],"tuning":[{"field":"LinkVisibilityScope","description":"Whether links allow anonymous/external access"},{"field":"DownloadBurstThreshold","description":"# of files downloaded within <5 mins (e.g., >50 files)"}],"log_sources":[{"component_id":"DC0025","component":"Cloud Storage Access","name":"m365:sharepoint","channel":"AnonymousLinkCreated, FileDownloaded","platforms":["Office Suite"],"analytic_id":"AN1330","source_url":"https://attack.mitre.org/detectionstrategies/DET0484#AN1330","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0025/"},{"component_id":"DC0002","component":"User Account Authentication","name":"azure:signinlogs","channel":"SigninSuccess","platforms":["Office Suite"],"analytic_id":"AN1330","source_url":"https://attack.mitre.org/detectionstrategies/DET0484#AN1330","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"}]}]}],"telemetry_references":[{"id":"DC0025","name":"Cloud Storage Access","tag":"Cloud Storage Access","page":"telemetry/DC0025/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0002","name":"User Account Authentication","tag":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component"},{"id":"DC0013","name":"User Account Metadata","tag":"User Account Metadata","page":"telemetry/DC0013/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0677","name":"AADInternals","page":"tools/S0677/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1091","name":"Pacu","page":"tools/S1091/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0683","name":"Peirates","page":"tools/S0683/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S9009","name":"TruffleHog","page":"tools/S9009/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0677","name":"AADInternals","page":"tools/S0677/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1091","name":"Pacu","page":"tools/S1091/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0683","name":"Peirates","page":"tools/S0683/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S9009","name":"TruffleHog","page":"tools/S9009/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0677","name":"AADInternals","url":"https://attack.mitre.org/software/S0677","kind":"tool","description":"AADInternals can collect files from a user’s OneDrive.(Citation: AADInternals)","relationship_id":"relationship--e8747d32-65e4-4a55-a5c8-e87136cc44da","references":[{"source_name":"AADInternals","description":"Dr. Nestori Syynimaa. (2018, October 25). AADInternals. Retrieved February 1, 2022.","url":"https://o365blog.com/aadinternals/"}]},{"id":"S0683","name":"Peirates","url":"https://attack.mitre.org/software/S0683","kind":"tool","description":"[Peirates](https://attack.mitre.org/software/S0683) can dump the contents of AWS S3 buckets. It can also retrieve service account tokens from kOps buckets in Google Cloud Storage or S3.(Citation: Peirates GitHub)","relationship_id":"relationship--2cf91706-674a-4ae0-8a4c-0d8d43eb6e1a","references":[{"source_name":"Peirates GitHub","description":"InGuardians. (2022, January 5). Peirates GitHub. Retrieved February 8, 2022.","url":"https://github.com/inguardians/peirates"}]},{"id":"S1091","name":"Pacu","url":"https://attack.mitre.org/software/S1091","kind":"tool","description":"[Pacu](https://attack.mitre.org/software/S1091) can enumerate and download files stored in AWS storage services, such as S3 buckets.(Citation: GitHub Pacu)","relationship_id":"relationship--d4fa4797-aec0-419b-83d8-8b06ea3ac06d","references":[{"source_name":"GitHub Pacu","description":"Rhino Security Labs. (2019, August 22). Pacu. Retrieved October 17, 2019.","url":"https://github.com/RhinoSecurityLabs/pacu"}]},{"id":"S9009","name":"TruffleHog","url":"https://attack.mitre.org/software/S9009","kind":"tool","description":"[TruffleHog](https://attack.mitre.org/software/S9009) has the ability to scan cloud storage services for credentials to include Amazon (AWS) S3 and Google Cloud Storage.(Citation: Black Hills Information Security TruffleHog January 2024)(Citation: Github TruffleSecurity Trufflehog April 2025)","relationship_id":"relationship--ee1effa5-b256-4a6a-b7da-2d9066d7dccd","references":[{"source_name":"Black Hills Information Security TruffleHog January 2024","description":"Chris Traynor. (2024, January 18). Rooting For Secrets with TruffleHog. Retrieved April 15, 2026.","url":"https://www.blackhillsinfosec.com/rooting-for-secrets-with-trufflehog/"},{"source_name":"Github TruffleSecurity Trufflehog April 2025","description":"Trufflesecurity. (2026, April 8). TruffleHog Enterprise. Retrieved April 15, 2026.","url":"https://github.com/trufflesecurity/trufflehog"}]}],"actors":[{"id":"G0117","name":"Fox Kitten","url":"https://attack.mitre.org/groups/G0117","kind":"intrusion-set","description":"[Fox Kitten](https://attack.mitre.org/groups/G0117) has obtained files from the victim's cloud storage instances.(Citation: CISA AA20-259A Iran-Based Actor September 2020)","relationship_id":"relationship--118c566e-2042-4566-99c2-308351d50a40","references":[{"source_name":"CISA AA20-259A Iran-Based Actor September 2020","description":"CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"id":"G0125","name":"HAFNIUM","url":"https://attack.mitre.org/groups/G0125","kind":"intrusion-set","description":"[HAFNIUM](https://attack.mitre.org/groups/G0125) has exfitrated data from OneDrive.(Citation: Microsoft Silk Typhoon MAR 2025)","relationship_id":"relationship--5afc74e6-789b-4402-89d2-cc7be1994cf5","references":[{"source_name":"Microsoft Silk Typhoon MAR 2025","description":"Microsoft Threat Intelligence . (2025, March 5). Silk Typhoon targeting IT supply chain. Retrieved March 20, 2025.","url":"https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/"}]},{"id":"G1015","name":"Scattered Spider","url":"https://attack.mitre.org/groups/G1015","kind":"intrusion-set","description":"[Scattered Spider](https://attack.mitre.org/groups/G1015) enumerates data stored in cloud resources for collection and exfiltration purposes.(Citation: CISA Scattered Spider Advisory November 2023)","relationship_id":"relationship--c021a96d-e4f2-4bd7-b1eb-315c518f16ca","references":[{"source_name":"CISA Scattered Spider Advisory November 2023","description":"CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"}]},{"id":"G1044","name":"APT42","url":"https://attack.mitre.org/groups/G1044","kind":"intrusion-set","description":"[APT42](https://attack.mitre.org/groups/G1044) has collected data from Microsoft 365 environments.(Citation: Mandiant APT42-untangling)(Citation: Mandiant APT42-charms)   ","relationship_id":"relationship--42e7fe7a-6fa3-420f-8d07-435832813791","references":[{"source_name":"Mandiant APT42-charms","description":"Mandiant. (n.d.). APT42: Crooked Charms, Cons and Compromises. Retrieved October 9, 2024.","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"},{"source_name":"Mandiant APT42-untangling","description":"Rozmann, O., et al. (2024, May 1). Uncharmed: Untangling Iran's APT42 Operations. Retrieved October 9, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"}]},{"id":"G1053","name":"Storm-0501","url":"https://attack.mitre.org/groups/G1053","kind":"intrusion-set","description":"[Storm-0501](https://attack.mitre.org/groups/G1053) had modified Azure Storage account resources through the `Microsoft.Storage/storageAccounts/write` operation to expose non-remotely accessible accounts for data exfiltration.(Citation: Microsoft Storm-0501 Embargo Ransomware August 2025)","relationship_id":"relationship--35589283-3028-444b-94d1-9b64ae6d8487","references":[{"source_name":"Microsoft Storm-0501 Embargo Ransomware August 2025","description":"Microsoft Threat Intelligence. (2025, August 27). Storm-0501’s evolving techniques lead to cloud-based ransomware. Retrieved October 19, 2025.","url":"https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"}]},{"id":"G1057","name":"ShinyHunters","url":"https://attack.mitre.org/groups/G1057","kind":"intrusion-set","description":"[ShinyHunters](https://attack.mitre.org/groups/G1057) has collected data from insecure cloud buckets.(Citation: SOCRadar_ShinyHunters_Mar2024)   ","relationship_id":"relationship--441bf771-bc3a-43ba-bd84-7d77f82d5ab3","references":[{"source_name":"SOCRadar_ShinyHunters_Mar2024","description":"SOCRadar. (2024, March 18). Dark Web Profile: ShinyHunters. Retrieved May 18, 2026.","url":"https://socradar.io/dark-web-profile-shinyhunters/"}]}],"mitigations":[{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Configure user permissions groups and roles for access to cloud storage.(Citation: Microsoft Azure Storage Security, 2019) Implement strict Identity and Access Management (IAM) controls to prevent access to storage solutions except for the applications, users, and services that require access.(Citation: Amazon S3 Security, 2019) Ensure that temporary access tokens are issued rather than permanent credentials, especially when access is being granted to entities outside of the internal security boundary.(Citation: Amazon  AWS Temporary Security Credentials)","relationship_id":"relationship--22dfe85e-3eeb-4b0a-ac61-b80f70a1f092","references":[{"source_name":"Microsoft Azure Storage Security, 2019","description":"Amlekar, M., Brooks, C., Claman, L., et. al.. (2019, March 20). Azure Storage security guide. Retrieved October 4, 2019.","url":"https://docs.microsoft.com/en-us/azure/storage/common/storage-security-guide"},{"source_name":"Amazon S3 Security, 2019","description":"Amazon. (2019, May 17). How can I secure the files in my Amazon S3 bucket?. Retrieved October 4, 2019.","url":"https://aws.amazon.com/premiumsupport/knowledge-center/secure-s3-resources/"},{"source_name":"Amazon  AWS Temporary Security Credentials","description":"Amazon. (n.d.). Temporary Security Credentials. Retrieved October 18, 2019.","url":"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html"}]},{"id":"M1022","name":"Restrict File and Directory Permissions","url":"https://attack.mitre.org/mitigations/M1022","kind":"course-of-action","description":"Use access control lists on storage systems and objects.","relationship_id":"relationship--be61f77a-93a3-4699-b134-52b199c7b196","references":[]},{"id":"M1032","name":"Multi-factor Authentication","url":"https://attack.mitre.org/mitigations/M1032","kind":"course-of-action","description":"Consider using multi-factor authentication to restrict access to resources and cloud storage APIs.(Citation: Amazon S3 Security, 2019)","relationship_id":"relationship--ee3162ad-e88e-401c-9fdf-e7f0784141a4","references":[{"source_name":"Amazon S3 Security, 2019","description":"Amazon. (2019, May 17). How can I secure the files in my Amazon S3 bucket?. Retrieved October 4, 2019.","url":"https://aws.amazon.com/premiumsupport/knowledge-center/secure-s3-resources/"}]},{"id":"M1037","name":"Filter Network Traffic","url":"https://attack.mitre.org/mitigations/M1037","kind":"course-of-action","description":"Cloud service providers support IP-based restrictions when accessing cloud resources. Consider using IP allowlisting along with user account management to ensure that data access is restricted not only to valid users but only from expected IP ranges to mitigate the use of stolen credentials to access data.","relationship_id":"relationship--cf63b75f-564f-4713-a5b3-1f102d098e8e","references":[]},{"id":"M1041","name":"Encrypt Sensitive Information","url":"https://attack.mitre.org/mitigations/M1041","kind":"course-of-action","description":"Encrypt data stored at rest in cloud storage.(Citation: Amazon S3 Security, 2019)(Citation: Microsoft Azure Storage Security, 2019) Managed encryption keys can be rotated by most providers. At a minimum, ensure an incident response plan to storage breach includes rotating the keys and test for impact on client applications.(Citation: Google Cloud Encryption Key Rotation)","relationship_id":"relationship--55fa32b7-b9d2-4c57-9614-b7793b2770f2","references":[{"source_name":"Amazon S3 Security, 2019","description":"Amazon. (2019, May 17). How can I secure the files in my Amazon S3 bucket?. Retrieved October 4, 2019.","url":"https://aws.amazon.com/premiumsupport/knowledge-center/secure-s3-resources/"},{"source_name":"Microsoft Azure Storage Security, 2019","description":"Amlekar, M., Brooks, C., Claman, L., et. al.. (2019, March 20). Azure Storage security guide. Retrieved October 4, 2019.","url":"https://docs.microsoft.com/en-us/azure/storage/common/storage-security-guide"},{"source_name":"Google Cloud Encryption Key Rotation","description":"Google. (n.d.). Key rotation. Retrieved October 18, 2019.","url":"https://cloud.google.com/kms/docs/key-rotation"}]},{"id":"M1047","name":"Audit","url":"https://attack.mitre.org/mitigations/M1047","kind":"course-of-action","description":"Frequently check permissions on cloud storage to ensure proper permissions are set to deny open or unprivileged access to resources.(Citation: Amazon S3 Security, 2019)","relationship_id":"relationship--e3e50d39-fa69-4fca-9353-259247dbd439","references":[{"source_name":"Amazon S3 Security, 2019","description":"Amazon. (2019, May 17). How can I secure the files in my Amazon S3 bucket?. Retrieved October 4, 2019.","url":"https://aws.amazon.com/premiumsupport/knowledge-center/secure-s3-resources/"}]}],"candidates":[{"id":"67374845-b4c8-4204-adcc-9b217b65d4f1","name":"Azure - Dump Azure Storage Account Objects via Azure CLI","platforms":["iaas:azure"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1530/T1530.yaml","description":"This test dumps the content of the storage account objects present in the file defined in file_shares_csv_file_path. Note that this file is created in the atomic test T1619 \"Azure - Enumerate Storage Account Objects via Key-based authentication using Azure CLI\". When created manually, it must contain the columns \"ResourceGroup\",\"StorageAccountName\", \"FileShareName\", \"ContainerName\", \"BlobName\".\n\nRequirements:\n    - The test is intended to be executed in interactive mode (with -Interactive parameter) in order to complete the az login command when MFA is required.\n    - The EntraID user must have the role \"Storage Account Contributor\", or a role with similar permissions.","inputs":{"output_folder":{"type":"path","default":"$env:temp\\T1530_storage_account_objects","description":"Folder path to output file share content to"},"storage_account_objects_csv_file_path":{"type":"path","default":"$env:temp\\T1619_storage_account_objects.csv","description":"Path to file that contains all storage account objects in form of a csv file. This may be the result from Test T1619 \"Azure - Enumerate Storage Account Objects via Key-based authentication using Azure CLI\"."}},"dependencies":[{"description":"Azure CLI must be installed"}],"source_definition_sha256":"758826c733f572bc75bdf570320aaa5da2f47bb3b9dee083517a572b001827fe"},{"id":"979356b9-b588-4e49-bba4-c35517c484f5","name":"AWS - Scan for Anonymous Access to S3","platforms":["iaas:aws"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1530/T1530.yaml","description":"Upon successful execution, this test will test for anonymous access to AWS S3 buckets and dumps all the files to a local folder. \n","inputs":{"s3_bucket_name":{"description":"Name of the bucket","type":"string","default":"redatomic-test2"}},"dependencies":[{"description":"Check if ~/.aws/credentials file has a default stanza is configured\n"}],"source_definition_sha256":"e6f3f5ba87438c7d01c7dd2532a1660aaf710ba1192a190bf6c8573f93973714"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1059.009":"/ttp-simulation/techniques/enterprise/T1059.009/","T1213":"/ttp-simulation/techniques/enterprise/T1213/","T1530":"/ttp-simulation/techniques/enterprise/T1530/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1530","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0025","collector":"illustrative-lab-collector","observation":{"action":"get_object","bucket":"lab-bucket","key":"demo.txt","actor":"lab-reader","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0013","collector":"illustrative-lab-collector","observation":{"account_id":"user-lab-1","enabled":true,"roles":["lab-reader"],"inventory_time":"2026-09-27T12:00:00Z"}}]}}