MITRE ATT&CKsub-technique
T1567.002 Exfiltration to Cloud Storage
- Domain
- enterprise
- Tactics
- Exfiltration
- Platforms
- ESXi, Linux, macOS, Windows
- Version
- 1.3
- Created
- 2020-03-09
Description
Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet.
Examples of cloud storage services include Dropbox and Google Docs. Exfiltration to these cloud storage services can provide a significant amount of cover to the adversary if hosts within the network are already communicating with the service.
Related
Subtechnique of · MITRE ATT&CK (1)
- T1567 Exfiltration Over Web Service technique
Tactic · MITRE ATT&CK (1)
- TA0010 Exfiltration tactic
Referenced by MITRE ATT&CK · mitigates (1)
- M1021 Restrict Web-Based Content mitigation
Referenced by MITRE ATT&CK · uses (44)
- S9034 Tsundere Botnet software (malware)
- G1052 Contagious Interview group
- G1053 Storm-0501 group
- G1051 Medusa Group group
- S1222 RIFLESPINE software (malware)
- S1170 ODAgent software (malware)
- S1172 OilBooster software (malware)
- C0040 APT41 DUST campaign
- G1024 Akira group
- S1102 Pcexter software (malware)
- G1022 ToddyCat group
- G1021 Cinnamon Tempest group
- G1015 Scattered Spider group
- C0022 Operation Dream Job campaign
- G1014 LuminousMoth group
- C0015 C0015 campaign
- S1040 Rclone software (tool)
- S1023 CreepyDrive software (malware)
- G1005 POLONIUM group
- G1006 Earth Lusca group
- G1003 Ember Bear group
- G0142 Confucius group
- S0660 Clambling software (malware)
- S0651 BoxCaon software (malware)
- S0635 BoomBox software (malware)
- S0629 RainyDay software (malware)
- G0129 Mustang Panda group
- G0128 ZIRCONIUM group
- G0125 HAFNIUM group
- G0119 Indrik Spider group
Referenced by Compliance · mitigates (5)
- CIS-13.10 Perform Application Layer Filtering CIS Safeguard v8.1
- CIS-9.3 Maintain and Enforce Network-Based URL Filters CIS Safeguard v8.1
- NIST-AC-20 Use of External Systems NIST 800-53 control
- NIST-AC-4 Information Flow Enforcement NIST 800-53 control
- NIST-SC-7 Boundary Protection NIST 800-53 control