Cross-Platform Detection of Data Transfer to Cloud Account, Detection Strategy DET0573
Excerpt
AN1580
Detects snapshot sharing, backup exports, or data object transfers from victim-owned cloud accounts to other cloud identities within the same provider (e.g., AWS, Azure) using snapshot sharing, S3 bucket policy updates, or SAS URI generation.
Log Sources
Data Component Name Channel
Snapshot Modification
(DC0058)
AWS:CloudTrail ModifySnapshotAttribute
Cloud Storage
Modification (DC0023)
AWS:CloudTrail PutBucketPolicy
Snapshot Creation
(DC0057)
AWS:CloudTrail CreateSnapshot
Snapshot Metadata
(DC0062)
AWS:CloudTrail CopySnapshot
Network Traffic Content
(DC0085)
AWS:VPCFlowLogs
High volume internal-to-internal IP transfer or cross-account cloud…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by MITRE ATT&CK on attack.mitre.org.
Mentioned in the excerpt
More from MITRE ATT&CK43
- techdoc_lite-deliverables-numbered option.dotxMITRE ATT&CK · Added 16 Jun
- Encrypted Channel, Technique T1573 - EnterpriseMITRE ATT&CK · Added 6 Apr
- Boot or Logon Autostart Execution: Time Providers, Sub-technique T1547.003 - EnterpriseMITRE ATT&CK · Added 6 Apr
- Boot or Logon Autostart Execution: LSASS Driver, Sub-technique T1547.008 - EnterpriseMITRE ATT&CK · Added 6 Apr
