macOS Cloud Storage Access Tools

Status: experimental
Severity: medium
Log source: product macos, service endpointsecurity
Author: Eric Brown - Nebulock, Inc.
Source: github.com/Nebulock-Inc/macos-coresigma

Detects execution of cloud storage CLI tools (aws, gsutil, rclone) which may indicate exfiltration to cloud storage services. Adversaries use cloud storage to exfiltrate data while blending in with legitimate traffic.

Known false positives

Legitimate cloud backup operations
DevOps and CI/CD pipelines
Automated data synchronization
System administration tasks

MITRE ATT&CK coverage

Tactic	Techniques
Exfiltration	`T1537` Transfer Data to Cloud Account `T1567.002` Exfiltration Over Web Service: Exfiltration to Cloud Storage

Rule body

title: macOS Cloud Storage Access Tools
id: 4a0366e3-01e0-4345-bf41-487b54871df7
status: experimental
description: 'Detects execution of cloud storage CLI tools (aws, gsutil, rclone) which
  may

  indicate exfiltration to cloud storage services. Adversaries use cloud storage

  to exfiltrate data while blending in with legitimate traffic.

  '
author: Eric Brown - Nebulock, Inc.
date: 2025/10/31
modified: 2025/10/31
references:
- https://attack.mitre.org/techniques/T1567/002/
- https://attack.mitre.org/techniques/T1537/
logsource:
  product: macos
  service: endpointsecurity
detection:
  selection_event:
    esf.event_type: 9
    event.action: exec
  selection_process:
    Image|endswith:
    - /aws
    - /gsutil
    - /rclone
    - /s3cmd
    - /azcopy
  selection_upload:
    CommandLine|contains:
    - s3 cp
    - s3 sync
    - gsutil cp
    - rclone copy
    - rclone sync
    - put
    - upload
  condition: selection_event and selection_process and selection_upload
falsepositives:
- Legitimate cloud backup operations
- DevOps and CI/CD pipelines
- Automated data synchronization
- System administration tasks
fields:
- Image
- CommandLine
- ProcessId
- ParentProcessId
- User
tags:
- attack.exfiltration
- attack.t1567.002
- attack.t1537
level: medium

Stages and Predicates

Stage 0: `condition`

selection_event and selection_process and selection_upload

Stage 1: `selection_event`

selection_event:
  esf.event_type: 9
  event.action: exec

Stage 2: `selection_process`

selection_process:
  Image|endswith:
  - /aws
  - /gsutil
  - /rclone
  - /s3cmd
  - /azcopy

Stage 3: `selection_upload`

selection_upload:
  CommandLine|contains:
  - s3 cp
  - s3 sync
  - gsutil cp
  - rclone copy
  - rclone sync
  - put
  - upload

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`gsutil cp` `put` `rclone copy` `rclone sync` `s3 cp` `s3 sync` `upload`	`field:"CommandLine" kind:match`
`Image`	ends_with	`/aws` `/azcopy` `/gsutil` `/rclone` `/s3cmd`	`field:"Image" kind:ends_with`
`esf.event_type`	eq	`9`	`field:"esf.event_type" kind:eq value:"9"`
`event.action`	eq	`exec`	`field:"EventType" kind:eq value:"exec"`