Cross-source coverage
T1567.002 / ATT&CK
Exfiltration Over Web Service: Exfiltration to Cloud Storage
38 rules across 6 sources.
Showing atomic-IOC rules · back to the default
From MITRE ATT&CK 19.2
Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet.
Examples of cloud storage services include Dropbox and Google Docs. Exfiltration to these cloud storage services can provide a significant amount of cover to the adversary if hosts within the network are already communicating with the service.
- Tactics
- Exfiltration
- Platforms
- ESXi · Linux · macOS · Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:Sysmonauditd:EXECVEauditd:SYSCALLNSM:Flowmacos:unifiedlogesxi:hostdesxi:vmkernel
How MITRE says to detect it DET0570
Detection Strategy for Exfiltration to Cloud Storage
Windows Analytic 1571
Unusual processes (e.g., powershell.exe, excel.exe) accessing large local files and subsequently initiating HTTPS POST requests to domains associated with cloud storage services (e.g., dropbox.com, drive.google.com, box.com). Defender perspective: correlation between file reads in sensitive directories and high outbound traffic volume to known storage APIs.
WinEventLog:SecurityEventCode=4663, 4670, 4656WinEventLog:SysmonEventCode=3, 22WinEventLog:SysmonEventCode=1
Linux Analytic 1572
Processes such as curl, wget, rclone, or custom scripts executing uploads to cloud storage endpoints. Defender perspective: detect chained events where tar/gzip is executed to compress files followed by HTTPS PUT/POST requests to known storage services.
auditd:EXECVEcurl -T, rclone copyauditd:SYSCALLread/open of sensitive file directoriesNSM:Flowlarge HTTPS outbound uploads
macOS Analytic 1573
Applications or scripts invoking cloud storage APIs (Dropbox sync, iCloud, Google Drive client) in unexpected contexts. Defender perspective: detect sensitive file reads by non-standard applications followed by unusual encrypted uploads to external cloud storage domains.
macos:unifiedlogexecution of curl, rclone, or Office apps invoking network sessionsmacos:unifiedlogfile read of sensitive directoriesmacos:unifiedlogoutbound HTTPS connections to cloud storage APIs
ESXi Analytic 1574
Unusual ESXi processes (vmx, hostd) reading datastore files and generating outbound HTTPS traffic toward external cloud storage endpoints. Defender perspective: anomalous datastore activity followed by network transfers to Dropbox, AWS S3, or other storage services.
esxi:hostddatastore file accessesxi:vmkernelnetwork flows to external cloud services
SigmaHQ/sigma
14 rules| Detection | Severity | Format |
|---|---|---|
| APT40 Dropbox Tool User Agent | High | Sigma |
| Curl File Upload To File Sharing Websites | High | Sigma |
| DNS Query for Anonfiles.com Domain - DNS Client | High | Sigma |
| DNS Query for Anonfiles.com Domain - Sysmon | High | Sigma |
| PUA - Rclone Execution | High | Sigma |
| PUA - Restic Backup Tool Execution | High | Sigma |
| Suspicious Dropbox API Usage | High | Sigma |
| DNS Query To MEGA Hosting Website | Medium | Sigma |
| DNS Query To MEGA Hosting Website - DNS Client | Medium | Sigma |
| Rclone Activity via Proxy | Medium | Sigma |
+ 4 more from SigmaHQ/sigma → showing the 10 highest-severity
elastic/detection-rules
12 rules| Detection | Severity | Format |
|---|---|---|
| AWS DynamoDB Table Exported to S3 | High | Elastic TOML |
| AWS RDS Snapshot Export | High | Elastic TOML |
| AWS S3 Bucket Replicated to Another Account | High | Elastic TOML |
| AWS EC2 Export Task | Medium | Elastic TOML |
| Azure Storage Blob Retrieval via AzCopy | Medium | Elastic TOML |
| Potential Data Exfiltration via Rclone | Medium | Elastic TOML |
| Potential PowerShell HackTool Script by Function Names | Medium | Elastic TOML |
| Suspicious AWS S3 Connection via Script Interpreter | Medium | Elastic TOML |
| Unusual Network Connection to Suspicious Web Service | Medium | Elastic TOML |
| AWS API Activity from Uncommon S3 Client by Rare User | Low | Elastic TOML |
+ 2 more from elastic/detection-rules → showing the 10 highest-severity
splunk/security_content
6 rules| Detection | Severity | Format |
|---|---|---|
| Cisco NVM - Rclone Execution With Network Activity | Undefined | SPL |
| Cisco Secure Firewall - Connection to File Sharing Domain | Undefined | SPL |
| Cisco Secure Firewall - Potential Data Exfiltration | Undefined | SPL |
| Gsuite Drive Share In External Email | Undefined | SPL |
| Windows Azure Storage Utility Execution Via CLI | Undefined | SPL |
| Windows OneDrive Share Mounted via Net | Undefined | SPL |
Azure/Azure-Sentinel
3 rules| Detection | Severity | Format |
|---|---|---|
| CreepyDrive request URL sequence | High | KQL |
| CreepyDrive URLs | High | KQL |
| Gentlemen Ransomware C2 domain connection | Undefined | KQL |
panther-labs/panther-analysis
2 rules| Detection | Severity | Format |
|---|---|---|
| Azure VM Disk SAS URI Generated | High | Panther Python |
| Azure Storage Blob Container Permissions Modified | Medium | Panther Python |
Wazuh Core Ruleset
1 rule| Detection | Severity | Format |
|---|---|---|
| A connection to cloud resource was started by · win.eventdata.commandLine = (?i)(live|outlook|google|drive|microsoft|dropbox) | High | Wazuh XML |