EXT-03 Extraction · Exfiltration & C2 KQL No YARA

Cloud Storage Abuse

Cloud Storage Abuse refers to the use of legitimate cloud-based storage services to transfer, store, or distribute attacker-controlled data outside a target environment..

Mappings

MITRE ATT&CK

T1567.002 Exfiltration to Cloud Storage

CVE examples

Not vulnerability-based — this capability is behavioural.

MalwareBazaar

Vidar

Summary

Cloud Storage Abuse refers to the use of legitimate cloud-based storage services to transfer, store, or distribute attacker-controlled data outside a target environment. This includes uploading sensitive files to external cloud accounts, synchronizing stolen data through cloud applications, or leveraging shared storage links to maintain persistent access to exfiltrated information. Within MalChain, this capability begins once data is successfully transmitted to an external cloud storage platform under attacker control. Attackers exploit implicit trust in widely used cloud services and encrypted communication channels to move data while appearing consistent with normal business operations. Routine reliance on cloud storage for collaboration and backup often allows unauthorized data transfer to occur without immediate detection. Trust abuse may involve using personal cloud accounts, creating hidden storage containers, or sharing files through temporary links presented as legitimate operational activity. Common abuse methods include:

Uploading files to external cloud storage accounts
Synchronizing sensitive data through cloud applications
Sharing data through public or private cloud links
Creating hidden storage containers for data staging
Using cloud services to distribute stolen information

Real world usage includes:

Data exfiltration campaigns targeting corporate intellectual property
Ransomware operators staging stolen files before encryption
Insider threat scenarios involving unauthorized data sharing
Persistent threats maintaining remote access to stolen information

Detection Guidance

Detection relies on monitoring cloud access behavior, file synchronization activity, and data transfer patterns associated with external storage services. Contextual correlation between data access and outbound transfer activity is essential to reduce false positives.

Monitor file uploads to external cloud storage platforms
Detect synchronization of sensitive data to unauthorized accounts
Correlate cloud access with unusual data access behavior
Alert on creation of new storage containers or shared links
Identify rare or unauthorized cloud communication patterns

KQL Detection Concepts

Cloud access events involving file upload or synchronization activity
Creation of shared links or new storage containers
Authentication events associated with external cloud services

YARA Detection Concepts

Scripts or binaries interacting with cloud storage APIs
Code patterns associated with automated file upload routines
Executable components transferring data to remote storage services

KQL Detection Rule

kql

// Cloud Storage Abuse: upload utilities / SDKs contacting cloud storage
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("s3.amazonaws.com","blob.core.windows.net","storage.googleapis.com","dropboxapi.com","drive.google.com","mega.nz")
| where InitiatingProcessFileName in~ ("powershell.exe","curl.exe","rclone.exe","python.exe","cmd.exe","aws.exe")
| project Timestamp, DeviceName, RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine

YARA Detection Rule

YARA is not meaningfully applicable to this primarily behavioral / network-telemetry capability. Rely on the KQL rule above plus network and identity detections.