T1567.002 Exfiltration to Cloud Storage
Sub-technique of T1567 Exfiltration Over Web Service
Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet. Examples of cloud storage services include Dropbox and Google Docs. Exfiltration to these cloud storage services can provide a significant amount of…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- APT40 Dropbox Tool User Agenthightest · proxy
- DNS Query for Anonfiles.com Domain - DNS Clienthightest · windows
- DNS Query for Anonfiles.com Domain - Sysmonhightest · windows
- PUA - Rclone Executionhightest · windows
- Suspicious Dropbox API Usagehightest · windows
- Curl File Upload To File Sharing Websiteshighexperimental · windows
- PUA - Restic Backup Tool Executionhighexperimental · windows
- DNS Query To MEGA Hosting Websitemediumtest · windows
- DNS Query To MEGA Hosting Website - DNS Clientmediumtest · windows
- Rclone Activity via Proxymediumtest · proxy
- Rclone Config File Creationmediumtest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.