T1530
Data from Cloud Storage
IaaS · Office Suite · SaaS2 pieces on this siteT1530 on attack.mitre.org
Adversaries may access data from cloud storage. Many IaaS providers offer solutions for online data object storage such as Amazon S3, Azure Storage, and Google Cloud Storage. Similarly, SaaS enterprise platforms such as Office 365 and Google Workspace provide cloud-based document storage to users through services such as OneDrive and Google Drive, while SaaS application providers such as Slack, Confluence, Salesforce, and Dropbox may provide cloud storage...
If this is happening now
Checklists and playbooks to open while the alert is still live.
Data theft extortion response plan: verify the claim, find the way out, own the notification
An extortion demand with nothing encrypted, or your name on a leak site. Three questions run in parallel with three owners: is the claim real, what left and how, and what you are obliged to say and to whom. A plan for answering each one on evidence rather than on the attacker's framing.
Company data in a public storage bucket
A researcher, a journalist or a scanner reports a storage bucket, blob container or shared link that anybody on the internet can read.
how MITRE says to see it
Multi-Platform Cloud Storage Exfiltration Behavior Chain
- Spike in object access from new IAM user or role followed by data exfiltration to external IPs
- OAuth token granted to external app followed by download of high-volume files in OneDrive/Google Drive
- Internal user account accesses shared links outside org followed by mass file download
what reduces it
- M1037 Filter Network Traffic. Cloud service providers support IP-based restrictions when accessing cloud resources. Consider using IP allowlisting along with user account management to ensure that data access is restricted not only to valid users but only from expected IP ranges to mitigate the use of stolen credentials to access data.
- M1018 User Account Management. Configure user permissions groups and roles for access to cloud storage. Implement strict Identity and Access Management (IAM) controls to prevent access to storage solutions except for the applications, users, and services that require access.
- M1022 Restrict File and Directory Permissions. Use access control lists on storage systems and objects.
- M1032 Multi-factor Authentication. Consider using multi-factor authentication to restrict access to resources and cloud storage APIs.
- M1047 Audit. Frequently check permissions on cloud storage to ensure proper permissions are set to deny open or unprivileged access to resources.
- M1041 Encrypt Sensitive Information. Encrypt data stored at rest in cloud storage. Managed encryption keys can be rotated by most providers. At a minimum, ensure an incident response plan to storage breach includes rotating the keys and test for impact on client applications.