Data from Cloud Storage (T1530) — ATT&CK

Events covered

4 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 11	FileCreate
Sysmon	Event ID 23	FileDelete (File Delete archived)
Sysmon	Event ID 26	FileDeleteDetected (File Delete logged)
Security-Auditing	Event ID 4663	An attempt was made to access an object.

Authoring guide

These 89 rules share fields, values, and exclusions.

Fields filtered most (110 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`data_stream.dataset`	22	`eq` 22	`aws.cloudtrail`, `o365.audit`, `azure.platformlogs`, `gcp.audit`, `azure.activitylogs`
`EventType`	20	`eq` 13, `in` 5, `wildcard` 2	`FileDownloaded`, `GetBlob`, `GetObject`, `PutBucketPolicy`, `CreateInstanceExportTask`
`event.outcome`	18	`eq` 18	`success`
`Provider_Name`	15	`eq` 14, `in` 1	`s3.amazonaws.com`, `OneDrive`, `SharePoint`, `cloudtrail.amazonaws.com`, `dynamodb.amazonaws.com`
`sourcetype`	10	`eq` 10	`aws:cloudtrail`, `o365:management:activity`, `google:gcp:pubsub:message`, `aws:s3:accesslogs`, `cisco:asa`
`operationName`	7	`eq` 6, `in` 2, `ne` 1	`GETBLOB`, `MICROSOFT.COMPUTE/DISKS/BEGINGETACCESS/ACTION`, `MICROSOFT.KEYVAULT/VAULTS/CERTIFICATES/READ`, `MICROSOFT.KEYVAULT/VAULTS/SECRETS/GETSECRET/ACTION`, `MICROSOFT.KEYVAULT/VAULTS/SECRETS/RECOVER/ACTION`
`resultType`	6	`in` 6	`Succeeded`, `Success`
`aws::eventName`	5	`eq` 5	`GetObject`, `PutBucketAcl`, `DeleteBucket`
`AlertSeverity_s`	4	`eq` 4	`High`, `Informational`, `Low`, `Medium`
`Operation`	3	`eq` 2, `starts_with` 1	`fileaccessed`, `filedownloaded`, `filesyncdownload*`
`aws::eventSource`	3	`eq` 2, `starts_with` 1	`s3.amazonaws.com`, `s3.`
`aws::userAgent`	3	`contains` 3	`Cyberduck`, `PnPCoreSDK`, `PnPPS`, `PowerShell`, `S3 Browser`
`count`	3	`gt` 3	`50`
`protoPayload.methodName`	3	`eq` 3	`storage.setIamPermissions`, `storage.objects.create`
`username`	3	`contains` 3	`serviceaccount`

Top indicator values (394 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.outcome`	`eq`	`success` elasticAWS API Activity from Uncommon S3 Client by Rare User elasticAWS CloudTrail Log Created elasticAWS CloudTrail Log Updated elasticAWS DynamoDB Scan by Unusual User elasticAWS EC2 Export Task elasticAWS S3 Bucket ACL Modified to Allow Public Access by New Identity elasticAWS S3 Credential File Retrieved from Bucket elasticAWS S3 Unauthenticated Bucket Access by Rare Source elasticAWS SNS Rare Protocol Subscription by User elasticAzure Storage Account Blob Public Access Enabled elasticGCP Pub/Sub Subscription Creation elasticGCP Pub/Sub Topic Creation elasticM365 SharePoint/OneDrive File Access via PowerShell	13	306
`event.outcome`	`eq`	`success` elasticAWS S3 Bucket Policy Added to Allow Public Access elasticAWS S3 Bucket Policy Added to Share with External Account elasticAWS S3 Rapid Bucket Posture API Calls from a Single Principal elasticM365 OneDrive/SharePoint Excessive File Downloads elasticM365 SharePoint Search for Sensitive Content	5	82
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS API Activity from Uncommon S3 Client by Rare User elasticAWS CloudTrail Log Created elasticAWS CloudTrail Log Updated elasticAWS DynamoDB Scan by Unusual User elasticAWS EC2 Export Task elasticAWS S3 Bucket ACL Modified to Allow Public Access by New Identity elasticAWS S3 Bucket Enumeration or Brute Force elasticAWS S3 Credential File Retrieved from Bucket elasticAWS S3 Unauthenticated Bucket Access by Rare Source elasticAWS SNS Rare Protocol Subscription by User	10	143
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS S3 Bucket Policy Added to Allow Public Access elasticAWS S3 Bucket Policy Added to Share with External Account elasticAWS S3 Rapid Bucket Posture API Calls from a Single Principal	3	40
`data_stream.dataset`	`eq`	`azure.platformlogs` elasticAzure Storage Anonymous Blob Access to Unusual Resource elasticAzure Storage Blob Retrieval via AzCopy	2	14
`data_stream.dataset`	`eq`	`gcp.audit` elasticGCP Pub/Sub Subscription Creation elasticGCP Pub/Sub Topic Creation	2	60
`data_stream.dataset`	`eq`	`o365.audit` elasticM365 OneDrive/SharePoint Excessive File Downloads elasticM365 SharePoint Search for Sensitive Content	2	8
`resultType`	`in`	`Succeeded` pantherAzure Key Vault Certificate Accessed pantherAzure Key Vault Secret Accessed or Recovered pantherAzure Storage Account Keys Listed pantherAzure Storage Blob Anonymous Access Enabled pantherAzure Storage File Share Created or Modified pantherAzure VM Disk SAS URI Generated	6	51
`resultType`	`in`	`Success` pantherAzure Key Vault Certificate Accessed pantherAzure Key Vault Secret Accessed or Recovered pantherAzure Storage Account Keys Listed pantherAzure Storage Blob Anonymous Access Enabled pantherAzure Storage File Share Created or Modified pantherAzure VM Disk SAS URI Generated	6	51
`Provider_Name`	`eq`	`s3.amazonaws.com` elasticAWS S3 Bucket ACL Modified to Allow Public Access by New Identity elasticAWS S3 Bucket Enumeration or Brute Force elasticAWS S3 Credential File Retrieved from Bucket elasticAWS S3 Unauthenticated Bucket Access by Rare Source	4	8
`Provider_Name`	`eq`	`s3.amazonaws.com` elasticAWS S3 Bucket Policy Added to Allow Public Access elasticAWS S3 Bucket Policy Added to Share with External Account elasticAWS S3 Rapid Bucket Posture API Calls from a Single Principal	3	8
`Provider_Name`	`eq`	`cloudtrail.amazonaws.com` elasticAWS CloudTrail Log Created elasticAWS CloudTrail Log Updated	2	5
`count`	`gt`	`50` splunkO365 Exfiltration via File Access splunkO365 Exfiltration via File Download splunkO365 Exfiltration via File Sync Download	3	5
`sourcetype`	`eq`	`aws:cloudtrail` splunkDetect New Open S3 buckets splunkDetect New Open S3 Buckets over AWS CLI splunkDetect Spike in S3 Bucket deletion	3	59
`sourcetype`	`eq`	`o365:management:activity` splunkO365 Exfiltration via File Access splunkO365 Exfiltration via File Download splunkO365 Exfiltration via File Sync Download	3	80
`sourcetype`	`eq`	`google:gcp:pubsub:message` splunkDetect GCP Storage access from a new IP splunkDetect New Open GCP Storage Buckets	2	4
`username`	`contains`	`serviceaccount` pantherKubernetes Admission Controller Webhook Created pantherKubernetes All Secrets Dumped Across Namespaces pantherKubernetes Data Copy via kubectl cp	3	24
`EventType`	`eq`	`PutBucketPolicy` elasticAWS S3 Bucket Policy Added to Allow Public Access elasticAWS S3 Bucket Policy Added to Share with External Account	2	2
`aws::eventName`	`eq`	`PutBucketAcl` splunkDetect New Open S3 buckets splunkDetect New Open S3 Buckets over AWS CLI	2	2
`aws::eventSource`	`eq`	`s3.amazonaws.com` splunkDetect New Open S3 buckets splunkDetect New Open S3 Buckets over AWS CLI	2	7
`aws::requestParameters`	`contains`	`Effect=Allow` elasticAWS S3 Bucket Policy Added to Allow Public Access elasticAWS S3 Bucket Policy Added to Share with External Account	2	2
`protoPayload.methodName`	`eq`	`storage.setIamPermissions` pantherGCP GCS IAM Permission Changes pantherGCS Bucket Made Public	2	2
`AlertSeverity_s`	`eq`	`High` kustoVaronis - High severity alerts detected	1
`AlertSeverity_s`	`eq`	`Informational` kustoVaronis - Informational alerts detected	1
`AlertSeverity_s`	`eq`	`Low` kustoVaronis - Low severity alerts detected	1
`AlertSeverity_s`	`eq`	`Medium` kustoVaronis - Medium severity alerts detected	1
`AlertType`	`eq`	`DLP` kustoNetskope - DLP Incident Spike	1
`AwsSecurityFindingGeneratorId`	`eq`	`security-control/SQS.3` kustoAWS Security Hub - Detect SQS Queue policy allowing public access	1
`CommandLine`	`contains`	`blob.core.windows.net` elasticAzCopy or Azure Storage Explorer Usage on Unusual Host	1
`CommandLine`	`contains`	`blob.storage.azure.net` elasticAzCopy or Azure Storage Explorer Usage on Unusual Host	1

Exclusions (61 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`aws::userAgent`	`contains`	`Terraform` elasticAWS CloudTrail Log Updated elasticAWS S3 Bucket ACL Modified to Allow Public Access by New Identity elasticAWS S3 Bucket Policy Added to Share with External Account elasticAWS SNS Rare Protocol Subscription by User	4
`aws::userAgent`	`contains`	`Pulumi` elasticAWS CloudTrail Log Updated elasticAWS S3 Bucket ACL Modified to Allow Public Access by New Identity elasticAWS S3 Bucket Policy Added to Share with External Account	3
`responseStatus`	`is_not_null`	pantherKubernetes Admission Controller Webhook Created pantherKubernetes All Secrets Dumped Across Namespaces pantherKubernetes Data Copy via kubectl cp	3
`responseStatus.code`	`ge`	`1` pantherKubernetes Admission Controller Webhook Created pantherKubernetes All Secrets Dumped Across Namespaces pantherKubernetes Data Copy via kubectl cp	3
`responseStatus.code`	`ge`	`400` pantherKubernetes Admission Controller Webhook Created pantherKubernetes All Secrets Dumped Across Namespaces pantherKubernetes Data Copy via kubectl cp	3
`responseStatus.code`	`le`	`16` pantherKubernetes Admission Controller Webhook Created pantherKubernetes All Secrets Dumped Across Namespaces pantherKubernetes Data Copy via kubectl cp	3
`username`	`in`	`aksService` pantherKubernetes Admission Controller Webhook Created pantherKubernetes All Secrets Dumped Across Namespaces pantherKubernetes Data Copy via kubectl cp	3
`username`	`in`	`masterclient` pantherKubernetes Admission Controller Webhook Created pantherKubernetes All Secrets Dumped Across Namespaces pantherKubernetes Data Copy via kubectl cp	3
`username`	`is_not_null`	pantherKubernetes Admission Controller Webhook Created pantherKubernetes All Secrets Dumped Across Namespaces pantherKubernetes Data Copy via kubectl cp	3
`username`	`starts_with`	`system:` pantherKubernetes Admission Controller Webhook Created pantherKubernetes All Secrets Dumped Across Namespaces pantherKubernetes Data Copy via kubectl cp	3
`username`	`starts_with`	`.iam.gserviceaccount.com` pantherKubernetes Admission Controller Webhook Created pantherKubernetes Data Copy via kubectl cp	2
`username`	`starts_with`	`azure-` pantherKubernetes Admission Controller Webhook Created pantherKubernetes Data Copy via kubectl cp	2
`Policy`	`is_null`	pantherAWS S3 Bucket Policy Allow With Not Principal pantherAWS S3 Bucket Principal Restrictions	2
`aws::userIdentity.type`	`eq`	`AWSService` elasticAWS S3 Bucket ACL Modified to Allow Public Access by New Identity elasticAWS S3 Credential File Retrieved from Bucket	2
`namespace`	`is_not_null`	pantherKubernetes All Secrets Dumped Across Namespaces pantherKubernetes Data Copy via kubectl cp	2

Data from Cloud Storage `T1530`

Events covered

Authoring guide

Fields filtered most (110 distinct)

Top indicator values (394 distinct)

Exclusions (61 distinct)

Rules under this technique

Elastic 25 rules

Splunk 10 rules

Kusto 16 rules

Panther 38 rules

Data from Cloud Storage T1530

Events covered

Authoring guide

Fields filtered most (110 distinct)

Top indicator values (394 distinct)

Exclusions (61 distinct)

Rules under this technique

Elastic 25 rules

Splunk 10 rules

Kusto 16 rules

Panther 38 rules

Data from Cloud Storage `T1530`