Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service.
A defender who is monitoring for large transfers to outside the cloud environment through normal file transfers or over command and control channels may not be watching for data transfers to another account within the same cloud provider. Such transfers may utilize existing cloud provider APIs and the internal address space of the cloud provider to blend into normal traffic or avoid data transfers over external network interfaces.(Citation: TLDRSec AWS Attacks)
Adversaries may also use cloud-native mechanisms to share victim data with adversary-controlled cloud accounts, such as creating anonymous file sharing links or, in Azure, a shared access signature (SAS) URI.(Citation: Microsoft Azure Storage Shared Access Signature)
Incidents have been observed where adversaries have created backups of cloud instances and transferred them to separate accounts.(Citation: DOJ GRU Indictment Jul 2018)
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CIS-16.7 | Use Standard Hardening Configuration Templates for Application Infrastructure | mitigates | T1537 | Transfer Data to Cloud Account |
Comments
Apply cloud service configuration templates that restrict or disable external data sharing and limit sharing to authorized users or domains to help prevent adversaries from exfiltrating data by transferring the data.
References
|
| CIS-13.4 | Perform Traffic Filtering Between Network Segments | mitigates | T1537 | Transfer Data to Cloud Account |
Comments
Implement network-based filtering restrictions between trusted and untrusted VPCs or equivalent network segments to prohibit unauthorized data transfers to external cloud accounts.
References
|
| CIS-18.3 | Remediate Penetration Test Findings | mitigates | T1537 | Transfer Data to Cloud Account |
Comments
This relationship applies when penetration testing identifies the described software configuration weakness and remediation of the finding changes the cloud applications and services to restrict external sharing, cross account transfers, and unapproved destinations, directly constraining data movement to adversary controlled cloud accounts.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1537 | Transfer Data to Cloud Account |
Comments
Using role-based access control (RBAC) to limit user-account and identity access management (IAM) permissions to the least privileges required can help prevent adversaries from transferring organizational data to cloud accounts they control.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1537 | Transfer Data to Cloud Account |
Comments
Destination-aware egress rules may block connections to unauthorized cloud environments. Basic port filtering cannot determine which cloud account owns an HTTPS destination, and some transfers occur entirely within the cloud.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1537 | Transfer Data to Cloud Account |
Comments
Egress filtering can restrict server connections to unauthorized cloud services or accounts, making cloud-based data transfer more difficult. The mitigation depends on destination-aware outbound controls.
References
|
| CIS-3.13 | Deploy a Data Loss Prevention Solution | mitigates | T1537 | Transfer Data to Cloud Account |
Comments
DLP is a direct control for blocking or alerting on exfiltration and data staging behaviors. DLP solutions commonly inspect and restrict uploads to external cloud services.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| action.malware.variety.Export data | Export data to another site or system | related-to | T1537 | Transfer Data to Cloud Account | |
| attribute.confidentiality.data_disclosure | Confirmed or potential data disclosure | related-to | T1537 | Transfer Data to Cloud Account |
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| vpc_service_controls | VPC Service Controls | technique_scores | T1537 | Transfer Data to Cloud Account |
Comments
This control may mitigate against exfiltration attempts to external cloud accounts by limiting egress of data from accounts and services contained within the VPC network perimeter.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| aws_network_firewall | AWS Network Firewall | technique_scores | T1537 | Transfer Data to Cloud Account |
Comments
AWS Network Firewall can mitigate transfer of data to an adversary-controlled cloud account by restricting outbound traffic to unauthorized cloud service destinations. Partial because protection depends on network-based filtering restrictions to prohibit data transfers to untrusted VPCs.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | technique_scores | T1537 | Transfer Data to Cloud Account |
Comments
IAM Access Analyzer can detect adversaries transferring data to cloud accounts they control. It generates a finding when a snapshot, S3 bucket, or other supported resource is newly shared with an external account. It is scored as Partial because it covers only supported resource types and generates findings periodically or when triggered rather than in real time.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | technique_scores | T1537 | Transfer Data to Cloud Account |
Comments
IAM Access Analyzer can protect against adversaries transferring data to cloud accounts they control. It identifies snapshots, S3 buckets, and other supported resources shared with external accounts, including shares an adversary creates, so administrators can revoke that access. It is scored as Partial because it covers only supported resource types, runs periodically or when triggered rather than in real time, and reports findings without revoking access itself.
References
|