THREATNOIR
Subscribe
MITRE ATT&CK · T1530

Data from Cloud Storage

MITRE · cited in 9 of our lessons

Explanation

What attackers do. Attackers access data held in cloud storage services such as object storage buckets, blob containers and shared drives, often through misconfigured public access or stolen credentials. This serves the Collection tactic.

How to defend. Block public access by default, use cloud security posture tools to find misconfigured storage, and apply least privilege to storage roles and keys. Enable data access logging, which is often off by default, and encrypt sensitive data with managed keys. Rotate and restrict long-lived access keys.

Signs to look for. Look for bulk listing or download operations, access from unfamiliar identities or networks, and storage that becomes public. A common gap is that object-level access logging was never enabled, leaving no record of what was read.

Open the technique on MITRE ATT&CK
The official text
Adversaries may access data from cloud storage. Many IaaS providers offer solutions for online data object storage such as Amazon S3, Azure Storage, and Google Cloud Storage. Similarly, SaaS enterprise platforms such as Office 365 and Google Workspace provide cloud-based document storage to users through services such as OneDrive and Google Drive, while SaaS application providers such as Slack, Confluence, Salesforce, and Dropbox may provide cloud storage solutions as a peripheral or primary use case of their platform. In some cases, as with IaaS-based cloud storage, there exists no overarching application (such as SQL or Elasticsearch) with which to interact with the stored objects: instead, data from these solutions is retrieved directly though the Cloud API. In SaaS applications, adversaries may be able to collect this data directly from APIs or backend cloud storage objects, rather than through their front-end application or interface (i.e., Data from Information Repositories).

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.