T1530 Data from Cloud Storage — Attack Simulation

DC0025 collection page — Explicitly select relevant object-read data events; keep principal, key, request ID and result without object contents.

Providers and collection configuration

• AWS CloudTrail for S3: Bucket control-plane events and explicitly selected object data events.
• Google Cloud Audit Logs: Cloud Storage access requires the relevant audit category and permissions.
• Azure storage resource logs: Use resource-specific data-plane diagnostics; Activity Log alone does not describe blob reads.

• Choose only the lab buckets/containers and prefixes. Enable read/write data-event collection when object access is needed; management events alone are insufficient.
• Keep administrative changes separately from object reads/writes. Set a cost budget and retention limit before enabling high-volume data logging.
• Preserve object version/key, requesting identity, action, source address, result and request ID. Verify the collector actually receives one benign read and one benign write.

Required normalized fields: action, bucket, key, actor, result.

[
  {
    "Name": "LabObjectReads",
    "FieldSelectors": [
      {
        "Field": "eventCategory",
        "Equals": [
          "Data"
        ]
      },
      {
        "Field": "resources.type",
        "Equals": [
          "AWS::S3::Object"
        ]
      },
      {
        "Field": "resources.ARN",
        "StartsWith": [
          "arn:aws:s3:::lab-bucket/demo/"
        ]
      },
      {
        "Field": "readOnly",
        "Equals": [
          "true"
        ]
      }
    ]
  }
]

Replace the placeholder with an owned lab bucket/prefix. Review costs and merge with required selectors; applying selectors can replace an existing selection. This does not enable management-event retention or object-write coverage.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0025",
  "collector": "illustrative-lab-collector",
  "observation": {
    "action": "get_object",
    "bucket": "lab-bucket",
    "key": "demo.txt",
    "actor": "lab-reader",
    "result": "success"
  }
}

Visibility limits: Storage metadata, listing, object access and bucket administration are different operations. Do not equate a successful request with proven exfiltration or complete content visibility.

DC0085 collection page — Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.

Providers and collection configuration

• Zeek: Connection and protocol metadata from traffic visible to the sensor.
• Suricata EVE: Configured flow, alert, DNS, HTTP, TLS and protocol records.

• Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.
• Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.
• Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection.

Required normalized fields: flow_id, protocol, method, path, payload_excerpt.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0085",
  "collector": "illustrative-lab-collector",
  "observation": {
    "flow_id": "lab-flow-1",
    "protocol": "http",
    "method": "GET",
    "path": "/lab-check",
    "payload_excerpt": "LAB_TELEMETRY_CHECK"
  }
}

Visibility limits: Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.

DC0002 collection page — Collect successful and failed sign-ins, authentication method, application and conditional-access context; distinguish account validation from session creation.

Providers and collection configuration

• Microsoft Entra sign-in logs: Interactive, non-interactive and workload sign-in contexts, subject to tenant features and access.
• Cloud identity service audit: Issuer-side credential and administrative events where the service supports them.
• Application audit instrumentation: Application-side use of identities and sessions; design fields without raw tokens.

• Enable/export the required identity sign-in and audit categories from the lab tenant to a protected destination. Document license, role and retention requirements.
• Correlate issuance or administrative changes with later sign-ins using non-secret credential IDs, application IDs, user IDs and correlation IDs.
• Exclude passwords, bearer tokens, cookies and private keys. Record success, failure, authentication context and application result separately.

Required normalized fields: account, application, result, reason, source_ip.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0002",
  "collector": "illustrative-lab-collector",
  "observation": {
    "account": "analyst@example.test",
    "application": "lab-portal",
    "result": "failure",
    "reason": "invalid_credential",
    "source_ip": "192.0.2.10"
  }
}

Visibility limits: A token creation record is not evidence of token use; a sign-in is not a complete record of every resource access. Some provider-side data is unavailable to the customer.

DC0013 collection page — Export an authorized directory/account inventory with stable IDs, roles, enabled state and collection time; compare snapshots without exposing credentials.

Providers and collection configuration

• osquery: Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.
• Linux Audit plus inventory snapshots: Events explain changes; snapshots describe state at collection time.

• Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.
• Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.
• Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset.

Required normalized fields: account_id, enabled, roles, inventory_time.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0013",
  "collector": "illustrative-lab-collector",
  "observation": {
    "account_id": "user-lab-1",
    "enabled": true,
    "roles": [
      "lab-reader"
    ],
    "inventory_time": "2026-09-27T12:00:00Z"
  }
}

Visibility limits: Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.

MITRE detection strategy

No exact-tagged Sigma source rule was imported. This does not establish that the technique is undetectable; the MITRE guidance and collection requirements remain relevant.

• S0677 AADInternals — tool.

  AADInternals can collect files from a user’s OneDrive.[AADInternals]

  Exact relationship: relationship--e8747d32-65e4-4a55-a5c8-e87136cc44da
• S0683 Peirates — tool.

  Peirates can dump the contents of AWS S3 buckets. It can also retrieve service account tokens from kOps buckets in Google Cloud Storage or S3.[Peirates GitHub]

  Exact relationship: relationship--2cf91706-674a-4ae0-8a4c-0d8d43eb6e1a
• S1091 Pacu — tool.

  Pacu can enumerate and download files stored in AWS storage services, such as S3 buckets.[GitHub Pacu]

  Exact relationship: relationship--d4fa4797-aec0-419b-83d8-8b06ea3ac06d
• S9009 TruffleHog — tool.

  TruffleHog has the ability to scan cloud storage services for credentials to include Amazon (AWS) S3 and Google Cloud Storage.[Black Hills Information Security TruffleHog January 2024][Github TruffleSecurity Trufflehog April 2025]

  Exact relationship: relationship--ee1effa5-b256-4a6a-b7da-2d9066d7dccd

This test dumps the content of the storage account objects present in the file defined in file_shares_csv_file_path. Note that this file is created in the atomic test T1619 "Azure - Enumerate Storage Account Objects via Key-based authentication using Azure CLI". When created manually, it must contain the columns "ResourceGroup","StorageAccountName", "FileShareName", "ContainerName", "BlobName".

Requirements:
- The test is intended to be executed in interactive mode (with -Interactive parameter) in order to complete the az login command when MFA is required.
- The EntraID user must have the role "Storage Account Contributor", or a role with similar permissions.

Pinned Atomic procedure · 67374845-b4c8-4204-adcc-9b217b65d4f1 · iaas:azure · powershell.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

• output_folder: Folder path to output file share content to (type path; source default $env:temp\T1530_storage_account_objects)
• storage_account_objects_csv_file_path: Path to file that contains all storage account objects in form of a csv file. This may be the result from Test T1619 "Azure - Enumerate Storage Account Objects via Key-based authentication using Azure CLI". (type path; source default $env:temp\T1619_storage_account_objects.csv)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• Azure CLI must be installed

Upon successful execution, this test will test for anonymous access to AWS S3 buckets and dumps all the files to a local folder.

Pinned Atomic procedure · 979356b9-b588-4e49-bba4-c35517c484f5 · iaas:aws · sh.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

• s3_bucket_name: Name of the bucket (type string; source default redatomic-test2)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• Check if ~/.aws/credentials file has a default stanza is configured

• M1018 User Account Management

  Configure user permissions groups and roles for access to cloud storage.[Microsoft Azure Storage Security, 2019] Implement strict Identity and Access Management (IAM) controls to prevent access to storage solutions except for the applications, users, and services that require access.[Amazon S3 Security, 2019] Ensure that temporary access tokens are issued rather than permanent credentials, especially when access is being granted to entities outside of the internal security boundary.[Amazon AWS Temporary Security Credentials]

• M1022 Restrict File and Directory Permissions

  Use access control lists on storage systems and objects.

• M1032 Multi-factor Authentication

  Consider using multi-factor authentication to restrict access to resources and cloud storage APIs.[Amazon S3 Security, 2019]

• M1037 Filter Network Traffic

  Cloud service providers support IP-based restrictions when accessing cloud resources. Consider using IP allowlisting along with user account management to ensure that data access is restricted not only to valid users but only from expected IP ranges to mitigate the use of stolen credentials to access data.

• M1041 Encrypt Sensitive Information

  Encrypt data stored at rest in cloud storage.[Amazon S3 Security, 2019][Microsoft Azure Storage Security, 2019] Managed encryption keys can be rotated by most providers. At a minimum, ensure an incident response plan to storage breach includes rotating the keys and test for impact on client applications.[Google Cloud Encryption Key Rotation]

• M1047 Audit

  Frequently check permissions on cloud storage to ensure proper permissions are set to deny open or unprivileged access to resources.[Amazon S3 Security, 2019]