EXPLORE
← Back to Explore
T1530

Data from Cloud Storage

Adversaries may access data from cloud storage. Many IaaS providers offer solutions for online data object storage such as Amazon S3, Azure Storage, and Google Cloud Storage. Similarly, SaaS enterprise platforms such as Office 365 and Google Workspace provide cloud-based document storage to users through services such as OneDrive and Google Drive, while SaaS application providers such as Slack, Confluence, Salesforce, and Dropbox may provide cloud storage solutions as a peripheral or primary us...

IaaSOffice SuiteSaaS
33
Detections
3
Sources
6
Threat Actors

BY SOURCE

22elastic10splunk_escu1kql

PROCEDURES (24)

Cloud2 detections

Auto-extracted: 2 detections for cloud

Aws2 detections

Auto-extracted: 2 detections for aws

Cloud2 detections

Auto-extracted: 2 detections for cloud

Service2 detections

Auto-extracted: 2 detections for service

Azure2 detections

Auto-extracted: 2 detections for azure

Service2 detections

Auto-extracted: 2 detections for service

Token1 detections

Auto-extracted: 1 detections for token

Service1 detections

Auto-extracted: 1 detections for service

Azure1 detections

Auto-extracted: 1 detections for azure

Download1 detections

Auto-extracted: 1 detections for download

Encrypt1 detections

Auto-extracted: 1 detections for encrypt

Bypass1 detections

Auto-extracted: 1 detections for bypass

Bypass1 detections

Auto-extracted: 1 detections for bypass

Phish1 detections

Auto-extracted: 1 detections for phish

Powershell1 detections

Auto-extracted: 1 detections for powershell

Token1 detections

Auto-extracted: 1 detections for token

Azure1 detections

Auto-extracted: 1 detections for azure

Phish1 detections

Auto-extracted: 1 detections for phish

Cloud1 detections

Auto-extracted: 1 detections for cloud

Powershell1 detections

Auto-extracted: 1 detections for powershell

Azure1 detections

Auto-extracted: 1 detections for azure

Cloud Monitoring1 detections

Auto-extracted: 1 detections for cloud monitoring

Suspicious1 detections

Auto-extracted: 1 detections for suspicious

Encrypt1 detections

Auto-extracted: 1 detections for encrypt

DETECTIONS (33)

AWS API Activity from Uncommon S3 Client by Rare User
elasticlow
AWS CloudTrail Log Created
elasticlow
AWS CloudTrail Log Updated
elastichigh
AWS DynamoDB Scan by Unusual User
elasticlow
AWS EC2 Export Task
elasticmedium
AWS S3 Bucket ACL Modified to Allow Public Access by New Identity
elasticmedium
AWS S3 Bucket Enumeration or Brute Force
elasticlow
AWS S3 Bucket Policy Added to Allow Public Access
elasticmedium
AWS S3 Bucket Policy Added to Share with External Account
elasticmedium
AWS S3 Credential File Retrieved from Bucket
elasticmedium
AWS S3 Rapid Bucket Posture API Calls from a Single Principal
elasticlow
AWS S3 Unauthenticated Bucket Access by Rare Source
elasticmedium
AWS SNS Rare Protocol Subscription by User
elasticlow
Azure Storage Account Blob Public Access Enabled
elasticmedium
Azure Storage Blob Retrieval via AzCopy
elasticmedium
Cisco ASA - Device File Copy Activity
splunk_escu
Detect GCP Storage access from a new IP
splunk_escu
Detect New Open GCP Storage Buckets
splunk_escu
Detect New Open S3 buckets
splunk_escu
Detect New Open S3 Buckets over AWS CLI
splunk_escu
Detect S3 access from a new IP
splunk_escu
Detect Spike in S3 Bucket deletion
splunk_escu
GCP Pub/Sub Subscription Creation
elasticlow
GCP Pub/Sub Topic Creation
elasticlow
Google Workspace Drive Encryption Key(s) Accessed from Anonymous User
elastichigh
Kubernetes Secret or ConfigMap Access via Azure Arc Proxy
elasticmedium
M365 OneDrive/SharePoint Excessive File Downloads
elasticmedium
M365 SharePoint Search for Sensitive Content
elasticlow
M365 SharePoint/OneDrive File Access via PowerShell
elastichigh
O365 Exfiltration via File Access
splunk_escu
O365 Exfiltration via File Download
splunk_escu
O365 Exfiltration via File Sync Download
splunk_escu
OneDrive Sync From Rare IP
kql