Opening of a cloud storage infrastructure, typically to collect/read its value (ex: AWS S3 GetObject)
Opening of a cloud storage infrastructure, typically to collect/read its value (ex: AWS S3 GetObject)
Domain | ID | Name | Detects | |
---|---|---|---|---|
Enterprise | T1619 | Cloud Storage Object Discovery |
Monitor for unusual queries to the cloud provider's storage service. Activity originating from unexpected sources may indicate improper permissions are set that is allowing access to data. Additionally, detecting failed attempts by a user for a certain object, followed by escalation of privileges by the same user, and access to the same object may be an indication of suspicious activity. |
|
Enterprise | T1530 | Data from Cloud Storage |
Monitor for unusual queries to the cloud provider's storage service. Activity originating from unexpected sources may indicate improper permissions are set and are allowing access to data. Additionally, detecting failed attempts by a user for a certain object, followed by escalation of privileges by the same user, and access to the same object may be an indication of suspicious activity. |
|
Enterprise | T1048 | Exfiltration Over Alternative Protocol |
Monitor for unusual queries to the cloud provider's storage service. Activity originating from unexpected sources may indicate improper permissions are set and are allowing access to data. Additionally, detecting failed attempts by a user for a certain object, followed by escalation of privileges by the same user, and access to the same object may be an indication of suspicious activity. |
Initial construction of new cloud storage infrastructure (ex: AWS S3 CreateBucket)
Initial construction of new cloud storage infrastructure (ex: AWS S3 CreateBucket)
Domain | ID | Name | Detects | |
---|---|---|---|---|
Enterprise | T1537 | Transfer Data to Cloud Account |
Monitor account activity for attempts to create and share data, such as snapshots or backups, with untrusted or unusual accounts. |
Removal of cloud storage infrastructure (ex: AWS S3 DeleteBucket)
Removal of cloud storage infrastructure (ex: AWS S3 DeleteBucket)
Domain | ID | Name | Detects | |
---|---|---|---|---|
Enterprise | T1485 | Data Destruction |
Monitor for unexpected deletion of a cloud storage infrastructure, such as the |
|
Enterprise | T1490 | Inhibit System Recovery |
Monitor for unexpected deletion of a cloud storage objects (ex: AWS |
An extracted list of cloud storage infrastructure (ex: AWS S3 ListBuckets or ListObjects)
An extracted list of cloud storage infrastructure (ex: AWS S3 ListBuckets or ListObjects)
Domain | ID | Name | Detects | |
---|---|---|---|---|
Enterprise | T1580 | Cloud Infrastructure Discovery |
Monitor cloud logs for API calls and other potentially unusual activity related to cloud data object storage enumeration. Discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Collection and Exfiltration, based on the information obtained. |
|
Enterprise | T1619 | Cloud Storage Object Discovery |
Monitor cloud logs for API calls used for file or object enumeration for unusual activity. System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Collection and Exfiltration, based on the information obtained. |
Contextual data about cloud storage infrastructure and activity around it such as name, size, or owner
Contextual data about cloud storage infrastructure and activity around it such as name, size, or owner
Domain | ID | Name | Detects | |
---|---|---|---|---|
Enterprise | T1537 | Transfer Data to Cloud Account |
Periodically baseline cloud storage infrastructure to identify malicious modifications or additions. |
Changes made to cloud storage infrastructure, including its settings and/or data (ex: AWS S3 PutObject or PutObjectAcl)
Changes made to cloud storage infrastructure, including its settings and/or data (ex: AWS S3 PutObject or PutObjectAcl)
Domain | ID | Name | Detects | |
---|---|---|---|---|
Enterprise | T1485 | Data Destruction |
Monitor for unexpected use of lifecycle policies. Where lifecycle policies are already in use, monitor for changes to cloud storage configurations and policies, such as buckets configured in the policy or unusually short retention periods. In AWS environments, monitor for |
|
.001 | Lifecycle-Triggered Deletion |
Monitor for unexpected use of lifecycle policies. Where lifecycle policies are already in use, monitor for changes to cloud storage configurations and policies, such as buckets configured in the policy or unusually short retention periods. In AWS environments, monitor for |
||
Enterprise | T1486 | Data Encrypted for Impact |
Monitor for changes made in cloud environments for events that indicate storage objects have been anomalously modified. |
|
Enterprise | T1537 | Transfer Data to Cloud Account |
Monitor for anomalous file transfer activity between accounts and/or to untrusted/unexpected VPCs. |