Technique.View on attack.mitre.org
Adversaries may access data from cloud storage.
Many IaaS providers offer solutions for online data object storage such as Amazon S3, Azure Storage, and Google Cloud Storage. Similarly, SaaS enterprise platforms such as Office 365 and Google Workspace provide cloud-based document storage to users through services such as OneDrive and Google Drive, while SaaS application providers such as Slack, Confluence, Salesforce, and Dropbox may provide cloud storage solutions as a peripheral or primary use case of their platform.
In some cases, as with IaaS-based cloud storage, there exists no overarching application (such as SQL or Elasticsearch) with which to interact with the stored objects: instead, data from these solutions is retrieved directly though the Cloud API. In SaaS applications, adversaries may be able to collect this data directly from APIs or backend cloud storage objects, rather than through their front-end application or interface (i.e., Data from Information Repositories).
Adversaries may collect sensitive data from these cloud storage solutions. Providers typically offer security guides to help end users configure systems, though misconfigurations are a common problem. There have been numerous incidents where cloud storage has been improperly secured, typically by unintentionally allowing public access to unauthenticated users, overly-broad access by all users, or even access for any anonymous person outside the control of the Identity Access Management system without even needing basic user permissions.
This open access may expose various types of sensitive data, such as credit cards, personally identifiable information, or medical records.
Adversaries may also obtain then abuse leaked credentials from source repositories, logs, or other means as a way to gain access to cloud storage objects.
Rules on DetectionCode tagged with T1530.
| Rule | Type | Risk | Data source |
|---|---|---|---|
| Cisco ASA - Device File Copy Activity | Anomaly | NULL | Cisco ASA Logs |
| Detect GCP Storage access from a new IP | Anomaly | NULL | |
| Detect New Open GCP Storage Buckets | TTP | NULL | |
| Detect New Open S3 buckets | TTP | NULL | AWS CloudTrail |
| Detect New Open S3 Buckets over AWS CLI | TTP | NULL | AWS CloudTrail |
| Detect S3 access from a new IP | Anomaly | NULL | |
| Detect Spike in S3 Bucket deletion | Anomaly | NULL | AWS CloudTrail |
| O365 Exfiltration via File Access | Anomaly | NULL | Office 365 Universal Audit Log |
| O365 Exfiltration via File Download | Anomaly | NULL | Office 365 Universal Audit Log |
| O365 Exfiltration via File Sync Download | Anomaly | NULL | Office 365 Universal Audit Log |
| Used by | Procedure example |
|---|---|
| GroupAPT42 | APT42 has collected data from Microsoft 365 environments. |
| GroupFox Kitten | Fox Kitten has obtained files from the victim's cloud storage instances. |
| GroupHAFNIUM | HAFNIUM has exfitrated data from OneDrive. |
| GroupScattered Spider | Scattered Spider enumerates data stored in cloud resources for collection and exfiltration purposes. |
| GroupShinyHunters | ShinyHunters has collected data from insecure cloud buckets. |
| GroupStorm-0501 | Storm-0501 had modified Azure Storage account resources through the `Microsoft.Storage/storageAccounts/write` operation to expose non-remotely accessible accounts for data exfiltration. |
| Used by | Procedure example |
|---|---|
| ToolAADInternals | AADInternals can collect files from a user’s OneDrive. |
| ToolPacu | Pacu can enumerate and download files stored in AWS storage services, such as S3 buckets. |
| ToolPeirates | Peirates can dump the contents of AWS S3 buckets. It can also retrieve service account tokens from kOps buckets in Google Cloud Storage or S3. |
| ToolTruffleHog | TruffleHog has the ability to scan cloud storage services for credentials to include Amazon (AWS) S3 and Google Cloud Storage. |
| Used by | Procedure example |
|---|---|
| Campaign2025 Poland Wiper Attacks | During the 2025 Poland Wiper Attacks, the adversaries leveraged stolen credentials within cloud services to download targeted data from SharePoint, and Teams. |
| CampaignC0027 | During C0027, Scattered Spider accessed victim OneDrive environments to search for VPN and MFA enrollment information, help desk instructions, and new hire guides. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
