T1567.002 — Exfiltration to Cloud Storage

Tactic: Exfiltration · Platforms: ESXi, Linux, macOS, Windows

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet. Examples of cloud storage services include Dropbox…

Sub-technique of Exfiltration Over Web Service (T1567).

Sigma detection rules (4)

T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

title: "T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage"
id: cf36a9ea-c97f-4461-b25b-aed25384ff2e
description: 'Detection Strategy for Exfiltration to Cloud Storage. (Data Component: Network Connection Creation; baseline tier: windows-eventid.) Tune using: CloudStorageDomains, ExfilVolumeThreshold, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1567/002
author: Shahrukh Khan
date: 2026-03-16
license: MIT
tags:
  - attack.exfiltration
  - attack.t1567.002

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection_dns:
    EventID: '22'
    QueryName|contains:
      - 'dropbox.com'
      - 'dropboxusercontent.com'
      - 'drive.google.com'
      - 'docs.google.com'
      - 'onedrive.live.com'
      - '1drv.ms'
      - 'box.com'
      - 'app.box.com'
      - 'mega.nz'
      - 'mega.co.nz'
      - 'mediafire.com'
      - 'pcloud.com'

  selection_conn:
    EventID: '3'
    DestinationHostname|contains:
      - 'dropbox.com'
      - 'dropboxusercontent.com'
      - 'drive.google.com'
      - 'docs.google.com'
      - 'onedrive.live.com'
      - '1drv.ms'
      - 'box.com'
      - 'app.box.com'
      - 'mega.nz'
      - 'mega.co.nz'
      - 'mediafire.com'
      - 'pcloud.com'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: (1 of selection_*) and not filter_system_account

falsepositives:
  - Legitimate corporate use of approved cloud storage/sync clients.

level: medium

T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

title: "T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage"
id: f74ac3fb-49c3-4ffe-83fa-084c59738e0d
description: 'Detects outbound/upload-oriented invocations of rclone, aws s3, and gsutil, requiring a local filesystem path as the source argument and a cloud remote/bucket as the destination argument, so downloads and routine cloud-management commands no longer trigger. Tune using: ApprovedRemotes, ApprovedBuckets, WorkHours.'
references:
  - https://attack.mitre.org/techniques/T1567/002
author: Shahrukh Khan
date: 2026-05-01
license: MIT
tags:
  - attack.exfiltration
  - attack.t1567.002

logsource:
  category: process_creation
  product: linux

detection:
  selection_rclone_upload:
    type: EXECVE
    a0|endswith: '/rclone'
    a1|contains:
      - 'sync'
      - 'copy'
      - 'copyto'
      - 'move'
      - 'moveto'
    a2|startswith:
      - '/'
      - './'
      - '~/'
    a3|contains: ':'
  selection_aws_upload:
    type: EXECVE
    a0|endswith: '/aws'
    a1: 's3'
    a2|contains:
      - 'cp'
      - 'sync'
      - 'mv'
    a3|startswith:
      - '/'
      - './'
      - '~/'
    a4|contains: 's3://'
  selection_gsutil_upload:
    type: EXECVE
    a0|endswith: '/gsutil'
    a1|contains:
      - 'cp'
      - 'rsync'
      - 'mv'
    a2|startswith:
      - '/'
      - './'
      - '~/'
    a3|contains: 'gs://'

  condition: 1 of selection_*

falsepositives:
  - 'Legitimate scheduled backups that push local data to an approved cloud bucket/remote using the same local-to-remote argument ordering; scope ApprovedRemotes/ApprovedBuckets to known-good destinations and flag only uploads to unapproved remotes or outside WorkHours.'

level: high

T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

title: "T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage"
id: 7597294a-6d1e-4555-9a3a-5a11733e20e3
description: 'Detection Strategy for Exfiltration to Cloud Storage. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: WatchedApps, EntropyThreshold.'
references:
  - https://attack.mitre.org/techniques/T1567/002
author: Shahrukh Khan
date: 2026-06-08
license: MIT
tags:
  - attack.exfiltration
  - attack.t1567.002

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/curl'
      - '/rclone'
    CommandLine|contains:
      - 'dropbox.com'
      - 'box.com'
      - 'drive.google.com'

  condition: selection

falsepositives:
  - Approved backup or sync utilities using curl or rclone to legitimately transfer files to sanctioned corporate cloud storage.

level: medium

T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

title: "T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage"
id: e42d1c7a-6620-4a56-8e24-b8ef609b3ab5
description: 'Detection Strategy for Exfiltration to Cloud Storage. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: DatastoreTransferThreshold, ApprovedStorageServices.'
references:
  - https://attack.mitre.org/techniques/T1567/002
author: Shahrukh Khan
date: 2026-03-19
license: MIT
tags:
  - attack.exfiltration
  - attack.t1567.002

logsource:
  product: esxi
  service: shell

detection:
  selection_tool:
    CommandLine|contains: 'curl '
  selection_cloud:
    CommandLine|contains:
      - 's3.amazonaws.com'
      - 'blob.core.windows.net'
      - 'storage.googleapis.com'
  selection_upload:
    CommandLine|contains:
      - '-T '
      - '--data-binary'
      - '-F '

  condition: selection_tool and selection_cloud and selection_upload

falsepositives:
  - Legitimate backup or log-shipping integrations that upload directly to an ApprovedStorageServices bucket from the host; tune the domain allowlist to the organizations known cloud storage endpoints.

level: high

Related sub-techniques

Explore