Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1537

Transfer Data to Cloud Account

IaaS · Office Suite · SaaSnothing on this site yetT1537 on attack.mitre.org

Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service. A defender who is monitoring for large transfers to outside the cloud environment through normal file transfers or over command and control channels may not be watching for data transfers to another account within the same cloud provider.

MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

1

Checklists and playbooks to open while the alert is still live.

how MITRE says to see it

Cross-Platform Detection of Data Transfer to Cloud Account

  • Detects snapshot sharing, backup exports, or data object transfers from victim-owned cloud accounts to other cloud identities within the same provider (e.g., AWS, Azure) using snapshot sharing, S3 bucket policy updates, or SAS URI generation.
  • Detects user activity that shares or syncs files with external domains via link generation, OneDrive external sharing, or file transfer actions involving non-whitelisted partner tenants.
  • Detects use of built-in SaaS sharing mechanisms to transfer ownership or share access of critical data to external tenants or untrusted users through API calls or link generation features.

what reduces it

  • M1037 Filter Network Traffic. Implement network-based filtering restrictions to prohibit data transfers to untrusted VPCs.
  • M1057 Data Loss Prevention. Data loss prevention can prevent and block sensitive data from being shared with individuals outside an organization.
  • M1018 User Account Management. Limit user account and IAM policies to the least privileges required.
  • M1054 Software Configuration. Configure appropriate data sharing restrictions in cloud services. For example, external sharing in Microsoft SharePoint and Google Drive can be turned off altogether, blocked for certain domains, or restricted to certain users.

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.