Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Exfiltration/ T1567.002

T1567.002Exfiltration to Cloud Storage

T1567.002 — Exfiltration to Cloud Storage is a MITRE ATT&CK technique in the Exfiltration tactic. Clankerusecase tracks 28 detection use cases covering it and 20 threat-intel articles citing it.

Exfiltration
View on the matrix → Filter Detection Library MITRE official spec ↗
28Use cases
20Articles
0Sub-techniques
1Tactic
↑ Parent technique: T1567 · Exfiltration Over Web Service

Use cases covering this technique (28)

Gsuite Drive Share In External Email ESCU actions · hunting P Cisco NVM - Rclone Execution With Network Activity ESCU actions · hunting P Windows Azure Storage Utility Execution Via CLI ESCU actions · hunting P Windows OneDrive Share Mounted via Net ESCU actions · hunting P Cisco Secure Firewall - Connection to File Sharing Domain ESCU actions · hunting P Cisco Secure Firewall - Potential Data Exfiltration ESCU actions · hunting P [LLM] ChainDrop C2 exfiltration from node/bun to npm-cache.com / pypi-get.com / js-mirror.com Bespoke c2 · alerting DSΣPDDCS [LLM] rclone data-exfiltration staging prior to Sinobi encryption Bespoke actions · alerting DSΣDDCS [LLM] CI runner egress to Megalodon secret-exfil C2 216.126.225.129:8443 Bespoke actions · hunting DSΣPDDCS [LLM] Gamaredon stealer exfiltration to S3-compatible cloud storage (Wasabi/Tebi/Intercolo) Bespoke actions · alerting DSΣPDDCS [LLM] Klue/Icarus: bulk Salesforce CRM record retrieval via connected app (Case/Contact/Account/Opportunity) Bespoke actions · alerting DSP [LLM] Atomic Arch C2/exfil: build-spawned egress to temp.sh and github.com/fardewoak/nodejs-argo Bespoke c2 · alerting DSΣPDDCS [LLM] Shai-Hulud npm worm: secret exfiltration to hardcoded webhook.site endpoint Bespoke actions · alerting DSΣPDDCS [LLM] Shai-Hulud worm GitHub Action workflow file dropped under .github/workflows Bespoke install · alerting DSΣPDDCS [LLM] Megalodon harvester: curl POST to C2 /collect endpoint on Linux runner Bespoke actions · alerting DSΣPDDCS [LLM] Nx Console / Shai-Hulud C2 connection (t.m-kosche.com, check.git-service.com, filev2.getsession.org, api.masscan.cloud, 83.142.209.194) Bespoke c2 · alerting DSΣPDDCS [LLM] GitHub audit log bulk private-repo clone burst (post Nx Console compromise pattern) Bespoke actions · alerting DSPDD [LLM] GraphWorm OneDrive /createUploadSession C2 from non-Office process Bespoke c2 · hunting DSΣPDDCS [LLM] WormFrp / Webworm Amazon S3 staging bucket access (wamanharipethe / whpjewellers) Bespoke actions · alerting DSΣPDDCS [LLM] Mini Shai-Hulud dead-drop git commit authored as claude@users.noreply.github.com Bespoke actions · alerting DSΣPDDCS [LLM] BirdCall RokRAT cloud-storage C2 beacon (Dropbox/pCloud) from non-browser process Bespoke c2 · hunting DSPDDCS [LLM] Outbound upload to file.io from non-browser process (CompactGopher exfil) Bespoke actions · alerting DSΣPDDCS [LLM] TeamPCP Trivy/KICS C2 callback to scan.aquasecurtiy.org / 45.148.10.212 Bespoke c2 · hunting DSΣPDD [LLM] TeamPCP supply-chain C2 — outbound to checkmarx[.]zone / 83.142.209.11 Bespoke c2 · hunting DSΣPDD [LLM] TeamPCP exfiltration archive — tpcp.tar.gz file creation on host Bespoke actions · alerting DSΣPDD [LLM] Exfiltration to kubernetes-el attacker webhook.site UUIDs (Pwn Request payload) Bespoke c2 · alerting DSΣPDD [LLM] AI agent skill exfiltrates GitHub token / env secrets via dynamic-context shell-out Bespoke actions · alerting DSΣPDDCS [LLM] Moq SponsorLink email exfil egress to cdn.devlooped.com / SponsorLink blob Bespoke c2 · hunting DSΣPDDCS

Articles citing this technique (20)

crit ChainDrop supply chain compromise: Anatomy of a self-propagating worm art-120
crit IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains art-188
high Harden-Runner Block Mode Now Available for macOS and Windows GitHub-Hosted Runners art-258
high Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances art-344
high When a vendor's breach becomes yours: lessons from the Klue incident art-356
crit 400+ AUR Packages Hijacked: What the “Atomic Arch” Campaign Means for Supply-Chain Security art-364
high Dev Machine Guard Now Scans Extensions Across Every Modern IDE art-418
high What MDM can't protect on developer machines (and what to do about it) art-432
high Megalodon: Mass GitHub Actions Secret Exfiltration Across 5,500+ Public Repositories art-447
crit 5 Supply Chain Attacks in 48 Hours: Why Securing One Layer Is Not Enough art-452
crit Webworm: New burrowing techniques art-459
crit TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages art-483
crit A rigged game: ScarCruft compromises gaming platform in a supply-chain attack art-500
crit GopherWhisper: A burrow full of malware art-529
high Behind the Scenes: How StepSecurity Detected and Helped Remediate the Largest npm Supply Chain Attack art-567
high Checkmarx KICS GitHub Action Compromised: Malware Injected in All Git Tags art-591
high kubernetes-el Compromised: How a Pwn Request Exploited a Popular Emacs Package art-627
crit Snyk Finds Prompt Injection in 36%, 1467 Malicious Payloads in a ToxicSkills Study of Agent Skills Supply Chain Compromise art-705
crit LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan art-758
high .NET developers alert: Moq NuGET package exfiltrates user emails from git art-1633