T1537 — Transfer Data to Cloud Account

Tactic: Exfiltration · Platforms: IaaS, Office Suite, SaaS

Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service. A defender who is monitoring for large transfers to outside the cloud environment through normal file…

Sigma detection rules (3)

T1537 Transfer Data to Cloud Account

title: T1537 Transfer Data to Cloud Account
id: b0e8d4ee-a216-431a-bd81-5db6b83b1572
description: 'Cross-Platform Detection of Data Transfer to Cloud Account. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CrossAccountIDList, Region, VolumeSizeThresholdGB, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1537
author: Shahrukh Khan
date: 2026-03-21
license: MIT
tags:
  - attack.exfiltration
  - attack.t1537

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource: 'ec2.amazonaws.com'
    eventName: 'ModifySnapshotAttribute'
    requestParameters.attribute: 'createVolumePermission'

  condition: selection

falsepositives:
  - Authorized sharing of EBS snapshots with approved partner, backup, or disaster-recovery AWS accounts.

level: high

T1537 Transfer Data to Cloud Account

title: T1537 Transfer Data to Cloud Account
id: fe1342d1-028d-4121-a999-691c2d00076f
description: 'Cross-Platform Detection of Data Transfer to Cloud Account. (Data Component: Cloud Storage Modification; baseline tier: fallback.) Tune using: UserContext, DomainReputationList, PayloadVolumeThreshold.'
references:
  - https://attack.mitre.org/techniques/T1537
author: Shahrukh Khan
date: 2026-06-15
license: MIT
tags:
  - attack.exfiltration
  - attack.t1537

logsource:
  product: saas
  service: googleworkspace

detection:
  selection_visibility_change:
    events.name: 'change_document_visibility'
    events.parameters.new_value: 'people_with_link'
  selection_ownership_transfer:
    events.name: 'transfer_document_ownership'

  condition: selection_visibility_change or selection_ownership_transfer

falsepositives:
  - Legitimate collaboration with external partners requiring link-based sharing, or a sanctioned bulk ownership transfer during a team reorganization; domain-reputation and payload-volume thresholds help isolate exfiltration to unknown external domains.

level: high

T1537 Transfer Data to Cloud Account

title: T1537 Transfer Data to Cloud Account
id: 05a0c78b-fb25-475b-9992-45f9bcee46e1
description: 'Cross-Platform Detection of Data Transfer to Cloud Account. (Data Component: Cloud Storage Modification; baseline tier: fallback.) Tune using: ExternalDomainList, TimeWindow, SharingMethod.'
references:
  - https://attack.mitre.org/techniques/T1537
author: Shahrukh Khan
date: 2026-06-07
license: MIT
tags:
  - attack.exfiltration
  - attack.t1537

logsource:
  product: m365
  service: unified

detection:
  selection_sharing:
    Operation:
      - 'SharingSet'
      - 'AnonymousLinkCreated'
      - 'SecureLinkCreated'
      - 'AddedToSecureLink'
  selection_workload:
    Workload:
      - 'SharePoint'
      - 'OneDrive'
  condition: selection_sharing and selection_workload

falsepositives:
  - Approved external collaboration with vendors or partners using sanctioned sharing links.

level: high

Explore