{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1537","id":"T1537","name":"Transfer Data to Cloud Account","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1537","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"3e9361e1ef865bcaef64fe792b07041f2043763ff63cbedb132bdcc1288d2073","description":"Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service.\n\nA defender who is monitoring for large transfers to outside the cloud environment through normal file transfers or over command and control channels may not be watching for data transfers to another account within the same cloud provider. Such transfers may utilize existing cloud provider APIs and the internal address space of the cloud provider to blend into normal traffic or avoid data transfers over external network interfaces.(Citation: TLDRSec AWS Attacks)\n\nAdversaries may also use cloud-native mechanisms to share victim data with adversary-controlled cloud accounts, such as creating anonymous file sharing links or, in Azure, a shared access signature (SAS) URI.(Citation: Microsoft Azure Storage Shared Access Signature)\n\nIncidents have been observed where adversaries have created backups of cloud instances and transferred them to separate accounts.(Citation: DOJ GRU Indictment Jul 2018) ","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1537","external_id":"T1537"},{"source_name":"AWS EBS Snapshot Sharing","description":"Amazon Web Services. (n.d.). Share an Amazon EBS snapshot. Retrieved March 2, 2022.","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-modifying-snapshot-permissions.html"},{"source_name":"TLDRSec AWS Attacks","description":"Clint Gibler and Scott Piper. (2021, January 4). Lesser Known Techniques for Attacking AWS Environments. Retrieved March 4, 2024.","url":"https://tldrsec.com/p/blog-lesser-known-aws-attacks"},{"source_name":"Azure Shared Access Signature","description":"Delegate access with a shared access signature. (2019, December 18). Delegate access with a shared access signature. Retrieved March 2, 2022.","url":"https://docs.microsoft.com/en-us/rest/api/storageservices/delegate-access-with-shared-access-signature"},{"source_name":"Azure Blob Snapshots","description":"Microsoft Azure. (2021, December 29). Blob snapshots. Retrieved March 2, 2022.","url":"https://docs.microsoft.com/en-us/azure/storage/blobs/snapshots-overview"},{"source_name":"Microsoft Azure Storage Shared Access Signature","description":"Microsoft. (2023, June 7). Grant limited access to Azure Storage resources using shared access signatures (SAS). Retrieved March 4, 2024.","url":"https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview"},{"source_name":"DOJ GRU Indictment Jul 2018","description":"Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved November 17, 2024.","url":"https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"}],"platforms":["IaaS","Office Suite","SaaS"],"environments":["cloud","onprem","saas"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0027","name":"Cloud Storage Metadata","page":"telemetry/DC0027/","kind":"attack_component","category":"Cloud storage","description":"Inventory attributes of cloud storage resources or objects.","collection_focus":"Take authorized metadata snapshots including resource ID, owner, region, encryption and policy summary; record observation time.","providers":[{"name":"AWS CloudTrail for S3","scope":"Bucket control-plane events and explicitly selected object data events.","source_id":"data_events"},{"name":"Google Cloud Audit Logs","scope":"Cloud Storage access requires the relevant audit category and permissions.","source_id":"gcp"},{"name":"Azure storage resource logs","scope":"Use resource-specific data-plane diagnostics; Activity Log alone does not describe blob reads.","source_id":"azure_storage"}],"configuration":["Choose only the lab buckets/containers and prefixes. Enable read/write data-event collection when object access is needed; management events alone are insufficient.","Keep administrative changes separately from object reads/writes. Set a cost budget and retention limit before enabling high-volume data logging.","Preserve object version/key, requesting identity, action, source address, result and request ID. Verify the collector actually receives one benign read and one benign write."],"configuration_example":null,"required_fields":["bucket","region","encryption_enabled","public_access"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0027","collector":"illustrative-lab-collector","observation":{"bucket":"lab-bucket","region":"lab-region","encryption_enabled":true,"public_access":false}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Storage metadata, listing, object access and bucket administration are different operations. Do not equate a successful request with proven exfiltration or complete content visibility.","sources":[{"id":"data_events","title":"AWS CloudTrail data-event selectors","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html"},{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"},{"id":"azure_storage","title":"Azure Blob Storage resource logging","url":"https://learn.microsoft.com/en-us/azure/storage/blobs/monitor-blob-storage"}],"association":"attack_component","anomaly_design":"Per principal and bucket/container: unusual object-read counts, transferred volume, new access pairs and bulk permission/deletion activity. Model backups, migrations and lifecycle policies separately."},{"id":"DC0023","name":"Cloud Storage Modification","page":"telemetry/DC0023/","kind":"attack_component","category":"Cloud storage","description":"Changes to cloud storage configuration, permissions or stored objects.","collection_focus":"Collect storage policy/ACL changes and relevant write data events; preserve before/after state where available.","providers":[{"name":"AWS CloudTrail for S3","scope":"Bucket control-plane events and explicitly selected object data events.","source_id":"data_events"},{"name":"Google Cloud Audit Logs","scope":"Cloud Storage access requires the relevant audit category and permissions.","source_id":"gcp"},{"name":"Azure storage resource logs","scope":"Use resource-specific data-plane diagnostics; Activity Log alone does not describe blob reads.","source_id":"azure_storage"}],"configuration":["Choose only the lab buckets/containers and prefixes. Enable read/write data-event collection when object access is needed; management events alone are insufficient.","Keep administrative changes separately from object reads/writes. Set a cost budget and retention limit before enabling high-volume data logging.","Preserve object version/key, requesting identity, action, source address, result and request ID. Verify the collector actually receives one benign read and one benign write."],"configuration_example":null,"required_fields":["resource","action","public_access_before","public_access_after","change_ticket"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0023","collector":"illustrative-lab-collector","observation":{"resource":"lab-bucket","action":"change_policy","public_access_before":false,"public_access_after":false,"change_ticket":"LAB-42"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Storage metadata, listing, object access and bucket administration are different operations. Do not equate a successful request with proven exfiltration or complete content visibility.","sources":[{"id":"data_events","title":"AWS CloudTrail data-event selectors","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html"},{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"},{"id":"azure_storage","title":"Azure Blob Storage resource logging","url":"https://learn.microsoft.com/en-us/azure/storage/blobs/monitor-blob-storage"}],"association":"attack_component","anomaly_design":"Per principal and bucket/container: unusual object-read counts, transferred volume, new access pairs and bulk permission/deletion activity. Model backups, migrations and lifecycle policies separately."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0057","name":"Snapshot Creation","page":"telemetry/DC0057/","kind":"attack_component","category":"Cloud control plane","description":"Creation of a snapshot or recovery-point artifact.","collection_focus":"Collect snapshot-create APIs and subsequent state; link snapshot to source volume/instance and requesting principal.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["snapshot_id","source_volume","action","state"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0057","collector":"illustrative-lab-collector","observation":{"snapshot_id":"snap-lab-1","source_volume":"vol-lab-1","action":"create","state":"pending"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."},{"id":"DC0062","name":"Snapshot Metadata","page":"telemetry/DC0062/","kind":"attack_component","category":"Cloud control plane","description":"Snapshot inventory including age, owner, source resource and permissions.","collection_focus":"Collect authorized describe/list metadata with observation time and resource IDs; preserve original provider fields.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["snapshot_id","owner","source_volume","state"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0062","collector":"illustrative-lab-collector","observation":{"snapshot_id":"snap-lab-1","owner":"lab-account","source_volume":"vol-lab-1","state":"completed"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."},{"id":"DC0058","name":"Snapshot Modification","page":"telemetry/DC0058/","kind":"attack_component","category":"Cloud control plane","description":"Changes to snapshot attributes, access policies or sharing state.","collection_focus":"Collect snapshot-attribute modifications and configuration snapshots; distinguish a permission change from modification of stored snapshot bytes.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["snapshot_id","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0058","collector":"illustrative-lab-collector","observation":{"snapshot_id":"snap-lab-1","attribute":"shared_with","before":[],"after":["lab-account-2"]}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."}],"detection":{"key":"enterprise/T1537","id":"T1537","name":"Transfer Data to Cloud Account","domain":"enterprise","platforms":["IaaS","Office Suite","SaaS"],"environments":["cloud","onprem","saas"],"source_url":"https://attack.mitre.org/techniques/T1537","technique_page":"techniques/enterprise/T1537/","page":"detections/enterprise/T1537/","status":"rule_source_available","counts":{"sigma":6,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[{"id":"69b3bd1e-b38a-462f-9a23-fbdbf63d2294","title":"Github Fork Private Repositories Setting Enabled/Cleared","status":"test","level":"medium","logsource":{"product":"github","service":"audit","definition":"Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"},"data_path":"data/detection-rules/69b3bd1e-b38a-462f-9a23-fbdbf63d2294.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/github/audit/github_fork_private_repos_enabled_or_cleared.yml","author":"Romain Gaillard (@romain-gaillard)","kind":"sigma"},{"id":"04ad83ef-1a37-4c10-b57a-81092164bf33","title":"Github Repository/Organization Transferred","status":"test","level":"medium","logsource":{"product":"github","service":"audit","definition":"Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"},"data_path":"data/detection-rules/04ad83ef-1a37-4c10-b57a-81092164bf33.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/github/audit/github_repo_or_org_transferred.yml","author":"Romain Gaillard (@romain-gaillard)","kind":"sigma"},{"id":"54b9a76a-3c71-4673-b4b3-2edb4566ea7b","title":"AWS EC2 VM Export Failure","status":"test","level":"low","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/54b9a76a-3c71-4673-b4b3-2edb4566ea7b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_ec2_vm_export_failure.yml","author":"Diogo Braz","kind":"sigma"},{"id":"78b3756a-7804-4ef7-8555-7b9024a02e2d","title":"AWS S3 Data Management Tampering","status":"test","level":"low","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/78b3756a-7804-4ef7-8555-7b9024a02e2d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_s3_data_management_tampering.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"abae8fec-57bd-4f87-aff6-6e3db989843d","title":"AWS Snapshot Backup Exfiltration","status":"test","level":"medium","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/abae8fec-57bd-4f87-aff6-6e3db989843d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_snapshot_backup_exfiltration.yml","author":"Darin Smith","kind":"sigma"},{"id":"2b669496-d215-47d8-bd9a-f4a45bf07cda","title":"Data Exfiltration to Unsanctioned Apps","status":"test","level":"medium","logsource":{"service":"threat_management","product":"m365"},"data_path":"data/detection-rules/2b669496-d215-47d8-bd9a-f4a45bf07cda.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/m365/threat_management/microsoft365_data_exfiltration_to_unsanctioned_app.yml","author":"Austin Songer @austinsonger","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0573","name":"Cross-Platform Detection of Data Transfer to Cloud Account","url":"https://attack.mitre.org/detectionstrategies/DET0573","stix_id":"x-mitre-detection-strategy--22a31282-d190-449b-a102-2d562f906b7d","relationship_id":"relationship--95e5c02b-7101-4399-8d56-b5758c3081a6","description":"","analytics":[{"id":"AN1580","name":"Analytic 1580","guidance":"Detects snapshot sharing, backup exports, or data object transfers from victim-owned cloud accounts to other cloud identities within the same provider (e.g., AWS, Azure) using snapshot sharing, S3 bucket policy updates, or SAS URI generation.","url":"https://attack.mitre.org/detectionstrategies/DET0573#AN1580","platforms":["IaaS"],"tuning":[{"field":"CrossAccountIDList","description":"List of external cloud accounts authorized for snapshot or bucket sharing"},{"field":"Region","description":"Geographic region in which the sharing occurs (may impact logging availability)"},{"field":"VolumeSizeThresholdGB","description":"Threshold to alert on snapshot size or object volume"},{"field":"TimeWindow","description":"Temporal window between snapshot creation and external sharing"}],"log_sources":[{"component_id":"DC0058","component":"Snapshot Modification","name":"AWS:CloudTrail","channel":"ModifySnapshotAttribute","platforms":["IaaS"],"analytic_id":"AN1580","source_url":"https://attack.mitre.org/detectionstrategies/DET0573#AN1580","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0058/"},{"component_id":"DC0023","component":"Cloud Storage Modification","name":"AWS:CloudTrail","channel":"PutBucketPolicy","platforms":["IaaS"],"analytic_id":"AN1580","source_url":"https://attack.mitre.org/detectionstrategies/DET0573#AN1580","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0023/"},{"component_id":"DC0057","component":"Snapshot Creation","name":"AWS:CloudTrail","channel":"CreateSnapshot","platforms":["IaaS"],"analytic_id":"AN1580","source_url":"https://attack.mitre.org/detectionstrategies/DET0573#AN1580","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0057/"},{"component_id":"DC0062","component":"Snapshot Metadata","name":"AWS:CloudTrail","channel":"CopySnapshot","platforms":["IaaS"],"analytic_id":"AN1580","source_url":"https://attack.mitre.org/detectionstrategies/DET0573#AN1580","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0062/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"AWS:VPCFlowLogs","channel":"High volume internal-to-internal IP transfer or cross-account cloud transfer","platforms":["IaaS"],"analytic_id":"AN1580","source_url":"https://attack.mitre.org/detectionstrategies/DET0573#AN1580","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]},{"id":"AN1581","name":"Analytic 1581","guidance":"Detects user activity that shares or syncs files with external domains via link generation, OneDrive external sharing, or file transfer actions involving non-whitelisted partner tenants.","url":"https://attack.mitre.org/detectionstrategies/DET0573#AN1581","platforms":["Office Suite"],"tuning":[{"field":"ExternalDomainList","description":"Known partner or adversarial cloud identities/domains"},{"field":"TimeWindow","description":"Duration between file access and external sharing"},{"field":"SharingMethod","description":"Type of link (anonymous, internal, organization-wide) to alert on"}],"log_sources":[{"component_id":"DC0023","component":"Cloud Storage Modification","name":"m365:unified","channel":"SharingSet","platforms":["Office Suite"],"analytic_id":"AN1581","source_url":"https://attack.mitre.org/detectionstrategies/DET0573#AN1581","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0023/"},{"component_id":"DC0027","component":"Cloud Storage Metadata","name":"m365:unified","channel":"AnonymousLinkCreated","platforms":["Office Suite"],"analytic_id":"AN1581","source_url":"https://attack.mitre.org/detectionstrategies/DET0573#AN1581","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0027/"},{"component_id":"DC0038","component":"Application Log Content","name":"m365:unified","channel":"FileAccessed","platforms":["Office Suite"],"analytic_id":"AN1581","source_url":"https://attack.mitre.org/detectionstrategies/DET0573#AN1581","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]},{"id":"AN1582","name":"Analytic 1582","guidance":"Detects use of built-in SaaS sharing mechanisms to transfer ownership or share access of critical data to external tenants or untrusted users through API calls or link generation features.","url":"https://attack.mitre.org/detectionstrategies/DET0573#AN1582","platforms":["SaaS"],"tuning":[{"field":"UserContext","description":"Whether the user is in a high-privileged or VIP group"},{"field":"DomainReputationList","description":"Allowlist or blocklist of external SaaS domains"},{"field":"PayloadVolumeThreshold","description":"Size or number of shared files triggering alert"}],"log_sources":[{"component_id":"DC0023","component":"Cloud Storage Modification","name":"saas:googledrive","channel":"drive.permission.add","platforms":["SaaS"],"analytic_id":"AN1582","source_url":"https://attack.mitre.org/detectionstrategies/DET0573#AN1582","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0023/"},{"component_id":"DC0027","component":"Cloud Storage Metadata","name":"saas:box","channel":"collaboration.invite","platforms":["SaaS"],"analytic_id":"AN1582","source_url":"https://attack.mitre.org/detectionstrategies/DET0573#AN1582","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0027/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0027","name":"Cloud Storage Metadata","tag":"Cloud Storage Metadata","page":"telemetry/DC0027/","kind":"attack_component"},{"id":"DC0023","name":"Cloud Storage Modification","tag":"Cloud Storage Modification","page":"telemetry/DC0023/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0057","name":"Snapshot Creation","tag":"Snapshot Creation","page":"telemetry/DC0057/","kind":"attack_component"},{"id":"DC0062","name":"Snapshot Metadata","tag":"Snapshot Metadata","page":"telemetry/DC0062/","kind":"attack_component"},{"id":"DC0058","name":"Snapshot Modification","tag":"Snapshot Modification","page":"telemetry/DC0058/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[{"id":"G1032","name":"INC Ransom","url":"https://attack.mitre.org/groups/G1032","kind":"intrusion-set","description":"[INC Ransom](https://attack.mitre.org/groups/G1032) has used Megasync to exfiltrate data to the cloud.(Citation: Secureworks GOLD IONIC April 2024)","relationship_id":"relationship--463d6149-8561-4e11-a5a7-c24faa34da62","references":[{"source_name":"Secureworks GOLD IONIC April 2024","description":"Counter Threat Unit Research Team. (2024, April 15). GOLD IONIC DEPLOYS INC RANSOMWARE. Retrieved June 5, 2024.","url":"https://www.secureworks.com/blog/gold-ionic-deploys-inc-ransomware"}]},{"id":"G1039","name":"RedCurl","url":"https://attack.mitre.org/groups/G1039","kind":"intrusion-set","description":"[RedCurl](https://attack.mitre.org/groups/G1039) has used cloud storage to exfiltrate data, in particular the megatools utilities were used to exfiltrate data to Mega, a file storage service.(Citation: group-ib_redcurl1)(Citation: group-ib_redcurl2)","relationship_id":"relationship--abbf5417-5112-424d-85f4-e4622675b319","references":[{"source_name":"group-ib_redcurl1","description":"Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source_name":"group-ib_redcurl2","description":"Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}]},{"id":"G1053","name":"Storm-0501","url":"https://attack.mitre.org/groups/G1053","kind":"intrusion-set","description":"[Storm-0501](https://attack.mitre.org/groups/G1053) has copied data from the victims environment to their own infrastructure leveraging AzCopy CLI.(Citation: Microsoft Storm-0501 Embargo Ransomware August 2025)","relationship_id":"relationship--16e7e622-1e34-48fe-954c-e1a4b103e204","references":[{"source_name":"Microsoft Storm-0501 Embargo Ransomware August 2025","description":"Microsoft Threat Intelligence. (2025, August 27). Storm-0501’s evolving techniques lead to cloud-based ransomware. Retrieved October 19, 2025.","url":"https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"}]}],"mitigations":[{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Limit user account and IAM policies to the least privileges required.","relationship_id":"relationship--27fde8e9-ab78-43aa-9642-14ac0cd958ff","references":[]},{"id":"M1037","name":"Filter Network Traffic","url":"https://attack.mitre.org/mitigations/M1037","kind":"course-of-action","description":"Implement network-based filtering restrictions to prohibit data transfers to untrusted VPCs.","relationship_id":"relationship--a5b61b67-8d99-4bc5-86d0-00739f0be666","references":[]},{"id":"M1054","name":"Software Configuration","url":"https://attack.mitre.org/mitigations/M1054","kind":"course-of-action","description":"Configure appropriate data sharing restrictions in cloud services. For example, external sharing in Microsoft SharePoint and Google Drive can be turned off altogether, blocked for certain domains, or restricted to certain users.(Citation: Google Workspace External Sharing) (Citation: Microsoft 365 External Sharing)","relationship_id":"relationship--8389c9f5-ace5-4240-a694-7008313fc168","references":[{"source_name":"Google Workspace External Sharing","description":"Google. (n.d.). Manage external sharing for your organization. Retrieved March 4, 2024.","url":"https://support.google.com/a/answer/60781"},{"source_name":"Microsoft 365 External Sharing","description":"Microsoft. (2023, October 11). Manage sharing settings for SharePoint and OneDrive in Microsoft 365. Retrieved March 4, 2024.","url":"https://learn.microsoft.com/en-us/sharepoint/turn-external-sharing-on-or-off"}]},{"id":"M1057","name":"Data Loss Prevention","url":"https://attack.mitre.org/mitigations/M1057","kind":"course-of-action","description":"Data loss prevention can prevent and block sensitive data from being shared with individuals outside an organization.(Citation: Microsoft Purview Data Loss Prevention) (Citation: Google Workspace Data Loss Prevention)","relationship_id":"relationship--1844caba-e446-4c82-aa0e-9f826c523a25","references":[{"source_name":"Google Workspace Data Loss Prevention","description":"Google. (n.d.). Use Workspace DLP to prevent data loss. Retrieved March 4, 2024.","url":"https://support.google.com/a/answer/9646351"},{"source_name":"Microsoft Purview Data Loss Prevention","description":"Microsoft. (2024, January 9). Learn about data loss prevention. Retrieved March 4, 2024.","url":"https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp"}]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1537":"/ttp-simulation/techniques/enterprise/T1537/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1537","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0027","collector":"illustrative-lab-collector","observation":{"bucket":"lab-bucket","region":"lab-region","encryption_enabled":true,"public_access":false}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0023","collector":"illustrative-lab-collector","observation":{"resource":"lab-bucket","action":"change_policy","public_access_before":false,"public_access_after":false,"change_ticket":"LAB-42"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0057","collector":"illustrative-lab-collector","observation":{"snapshot_id":"snap-lab-1","source_volume":"vol-lab-1","action":"create","state":"pending"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0062","collector":"illustrative-lab-collector","observation":{"snapshot_id":"snap-lab-1","owner":"lab-account","source_volume":"vol-lab-1","state":"completed"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0058","collector":"illustrative-lab-collector","observation":{"snapshot_id":"snap-lab-1","attribute":"shared_with","before":[],"after":["lab-account-2"]}}]}}