Detects snapshot sharing, backup exports, or data object transfers from victim-owned cloud accounts to other cloud identities within the same provider (e.g., AWS, Azure) using snapshot sharing, S3 bucket policy updates, or SAS URI generation.
| Data Component | Name | Channel |
|---|---|---|
| Snapshot Modification (DC0058) | AWS:CloudTrail | ModifySnapshotAttribute |
| Cloud Storage Modification (DC0023) | AWS:CloudTrail | PutBucketPolicy |
| Snapshot Creation (DC0057) | AWS:CloudTrail | CreateSnapshot |
| Snapshot Metadata (DC0062) | AWS:CloudTrail | CopySnapshot |
| Network Traffic Content (DC0085) | AWS:VPCFlowLogs | High volume internal-to-internal IP transfer or cross-account cloud transfer |
| Field | Description |
|---|---|
| CrossAccountIDList | List of external cloud accounts authorized for snapshot or bucket sharing |
| Region | Geographic region in which the sharing occurs (may impact logging availability) |
| VolumeSizeThresholdGB | Threshold to alert on snapshot size or object volume |
| TimeWindow | Temporal window between snapshot creation and external sharing |
Detects user activity that shares or syncs files with external domains via link generation, OneDrive external sharing, or file transfer actions involving non-whitelisted partner tenants.
| Data Component | Name | Channel |
|---|---|---|
| Cloud Storage Modification (DC0023) | m365:unified | SharingSet |
| Cloud Storage Metadata (DC0027) | m365:unified | AnonymousLinkCreated |
| Application Log Content (DC0038) | m365:unified | FileAccessed |
| Field | Description |
|---|---|
| ExternalDomainList | Known partner or adversarial cloud identities/domains |
| TimeWindow | Duration between file access and external sharing |
| SharingMethod | Type of link (anonymous, internal, organization-wide) to alert on |
Detects use of built-in SaaS sharing mechanisms to transfer ownership or share access of critical data to external tenants or untrusted users through API calls or link generation features.
| Data Component | Name | Channel |
|---|---|---|
| Cloud Storage Modification (DC0023) | saas:googledrive | drive.permission.add |
| Cloud Storage Metadata (DC0027) | saas:box | collaboration.invite |
| Field | Description |
|---|---|
| UserContext | Whether the user is in a high-privileged or VIP group |
| DomainReputationList | Allowlist or blocklist of external SaaS domains |
| PayloadVolumeThreshold | Size or number of shared files triggering alert |