Home/ MITRE Matrix/ Collection/ T1530

T1530Data from Cloud Storage

T1530 — Data from Cloud Storage is a MITRE ATT&CK technique in the Collection tactic. Clankerusecase tracks 19 detection use cases covering it and 7 threat-intel articles citing it.

Collection

View on the matrix → Filter Detection Library MITRE official spec ↗

19Use cases

7Articles

0Sub-techniques

1Tactic

Use cases covering this technique (19)

[WEEKLY] OAuth Device-Code Consent Phish to Cross-IP Cloud Token Replay Internal c2 · alerting DSPDD [WEEKLY] Vendor / Third-Party OAuth App or SP Sign-in From Unbaselined Egress Followed by Bulk SaaS Object Read Internal actions · alerting DSPDD Cisco ASA - Device File Copy Activity ESCU actions · hunting P Detect GCP Storage access from a new IP ESCU actions · hunting P Detect New Open GCP Storage Buckets ESCU actions · alerting P Detect New Open S3 buckets ESCU actions · alerting P Detect New Open S3 Buckets over AWS CLI ESCU actions · alerting P Detect S3 access from a new IP ESCU actions · hunting P Detect Spike in S3 Bucket deletion ESCU actions · hunting P O365 Exfiltration via File Access ESCU actions · hunting P O365 Exfiltration via File Download ESCU actions · hunting P O365 Exfiltration via File Sync Download ESCU actions · hunting P [LLM] Bulk M365 / SharePoint / OneDrive file download by a single identity (cloud data theft) Bespoke actions · alerting DSP [LLM] Bulk enumeration of 9router /api/usage/request-details (conversation-history exfiltration) Bespoke actions · hunting SP [LLM] Post-device-code token abuse: mailbox / OneDrive / Teams access from a new IP after device-code sign-in Bespoke actions · alerting DS [LLM] Foreign / non-Vertex principal accessing Vertex AI staging-bucket objects Bespoke actions · hunting ΣPDD [LLM] GitHub audit log bulk private-repo clone burst (post Nx Console compromise pattern) Bespoke actions · alerting DSPDD [LLM] Node.js process bulk-reading cloud & SCM credential files in single session Bespoke actions · hunting DSPDDCS [LLM] WAF-Role mass S3 bucket enumeration and object download Bespoke actions · alerting PDDCW

Articles citing this technique (7)

high Health-ISAC warns of rising ShinyHunters data theft attacks on healthcare art-07

crit [GHSA / CRITICAL] GHSA-vjc7-jrh9-9j86: 9router has unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats art-237

crit When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft website art-246

crit Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE art-327

crit 5 Supply Chain Attacks in 48 Hours: Why Securing One Layer Is Not Enough art-406

crit Active Supply Chain Attack: Malicious node-ipc Versions Published to npm art-427

high A technical analysis of the Capital One cloud misconfiguration breach art-3495