T1530 — Data from Cloud Storage

Tactic: Collection · Platforms: IaaS, Office Suite, SaaS

Adversaries may access data from cloud storage. Many IaaS providers offer solutions for online data object storage such as Amazon S3, Azure Storage, and Google Cloud Storage. Similarly, SaaS enterprise platforms such as Office 365 and Google Workspace provide cloud-based document storage to users…

Sigma detection rules (3)

T1530 Data from Cloud Storage

title: T1530 Data from Cloud Storage
id: dff344e3-4d62-4ecb-ad8b-7ab70918dec3
description: 'Multi-Platform Cloud Storage Exfiltration Behavior Chain. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TimeWindow, ExternalIPAllowList.'
references:
  - https://attack.mitre.org/techniques/T1530
author: Shahrukh Khan
date: 2026-02-27
license: MIT
tags:
  - attack.collection
  - attack.t1530

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource: 's3.amazonaws.com'
    eventName:
      - 'GetObject'
      - 'ListObjects'
      - 'ListObjectsV2'
  filter_known_ip:
    sourceIPAddress|cidr: '10.0.0.0/8'

  condition: selection and not filter_known_ip

falsepositives:
  - Normal application read access to S3 objects originating from allow-listed internal service IP ranges.

level: medium

T1530 Data from Cloud Storage

title: T1530 Data from Cloud Storage
id: ff47fa2f-c0b4-447e-9c28-8afe2458a918
description: 'Multi-Platform Cloud Storage Exfiltration Behavior Chain. (Data Component: Cloud Storage Access; baseline tier: fallback.) Tune using: AppRegistrationNamePattern, DownloadThresholdMB.'
references:
  - https://attack.mitre.org/techniques/T1530
author: Shahrukh Khan
date: 2026-04-29
license: MIT
tags:
  - attack.collection
  - attack.t1530

logsource:
  product: m365
  service: unified

detection:
  selection_workload:
    Workload: 'SharePoint'
  selection_op:
    Operation:
      - 'FileDownloaded'
      - 'FileSyncDownloadedFull'
      - 'FileAccessed'
  selection_app:
    Operation: 'Add service principal'
  condition: (selection_workload and selection_op) or selection_app

falsepositives:
  - Bulk downloads by backup tools or approved third party app registrations performing legitimate data sync.

level: medium

T1530 Data from Cloud Storage

title: T1530 Data from Cloud Storage
id: 360487d1-0685-46a2-ad60-6267b8a6de67
description: 'Multi-Platform Cloud Storage Exfiltration Behavior Chain. (Data Component: Cloud Storage Access; baseline tier: fallback.) Tune using: LinkVisibilityScope, DownloadBurstThreshold.'
references:
  - https://attack.mitre.org/techniques/T1530
author: Shahrukh Khan
date: 2026-03-03
license: MIT
tags:
  - attack.collection
  - attack.t1530

logsource:
  product: m365
  service: sharepoint

detection:
  selection_share:
    Operation:
      - 'SharingSet'
      - 'AnonymousLinkCreated'
      - 'SecureLinkCreated'
  selection_download:
    Operation:
      - 'FileDownloaded'
      - 'FileSyncDownloadedFull'
  condition: selection_share or selection_download

falsepositives:
  - Legitimate bulk sharing or migration activity performed by IT staff or approved sync clients.

level: medium

Explore