Adversaries may access data from cloud storage.
Many IaaS providers offer solutions for online data object storage such as Amazon S3, Azure Storage, and Google Cloud Storage. Similarly, SaaS enterprise platforms such as Office 365 and Google Workspace provide cloud-based document storage to users through services such as OneDrive and Google Drive, while SaaS application providers such as Slack, Confluence, Salesforce, and Dropbox may provide cloud storage solutions as a peripheral or primary use case of their platform.
In some cases, as with IaaS-based cloud storage, there exists no overarching application (such as SQL or Elasticsearch) with which to interact with the stored objects: instead, data from these solutions is retrieved directly though the Cloud API. In SaaS applications, adversaries may be able to collect this data directly from APIs or backend cloud storage objects, rather than through their front-end application or interface (i.e., Data from Information Repositories).
Adversaries may collect sensitive data from these cloud storage solutions. Providers typically offer security guides to help end users configure systems, though misconfigurations are a common problem.(Citation: Amazon S3 Security, 2019)(Citation: Microsoft Azure Storage Security, 2019)(Citation: Google Cloud Storage Best Practices, 2019) There have been numerous incidents where cloud storage has been improperly secured, typically by unintentionally allowing public access to unauthenticated users, overly-broad access by all users, or even access for any anonymous person outside the control of the Identity Access Management system without even needing basic user permissions.
This open access may expose various types of sensitive data, such as credit cards, personally identifiable information, or medical records.(Citation: Trend Micro S3 Exposed PII, 2017)(Citation: Wired Magecart S3 Buckets, 2019)(Citation: HIPAA Journal S3 Breach, 2017)(Citation: Rclone-mega-extortion_05_2021)
Adversaries may also obtain then abuse leaked credentials from source repositories, logs, or other means as a way to gain access to cloud storage objects.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| action.malware.variety.Capture stored data | Capture data stored on system disk | related-to | T1530 | Data from Cloud Storage | |
| attribute.confidentiality.data_disclosure | Confirmed or potential data disclosure | related-to | T1530 | Data from Cloud Storage |
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| access_transparency | Access Transparency | technique_scores | T1530 | Data from Cloud Storage |
Comments
Access Transparency provides visibility into Google's access to customer data in the form of audit logs. This may expose and detect malicious access of data from cloud storage by compromised Google personnel accounts.
References
|
| advanced_protection_program | Advanced Protection Program | technique_scores | T1530 | Data from Cloud Storage |
Comments
Advanced Protection Program enables the use of a security key for multi-factor authentication. Restricting access via MFA provides significant protection against adversaries accessing data objects from cloud storage.
References
|
| chrome_enterprise_premium | Chrome Enterprise Premium | technique_scores | T1530 | Data from Cloud Storage |
Comments
Chrome Enterprise Premium Access Context Manager allows organizations to manage and control access to sensitive content and applications based on user identity, device context, and other factors, essentially acting as a cloud-based content access manager with granular control capabilities.
References
|
| cloud_ngfw | Cloud Next-Generation Firewall (NGFW)_ | technique_scores | T1530 | Data from Cloud Storage |
Comments
Cloud NGFW can allow or deny traffic based on the traffic's protocol, destination ports, sources, and destinations. This functionality can be used to block adversaries from accessing resources such as cloud storage objects by implementing restrictions on which IP addresses and domains can access the resources (e.g., allow lists). However, since cloud storage objects are located outside the virtual private cloud where Cloud NGFW protect, the mapping is only given a score of Partial.
References
|
| cloud_storage | Cloud Storage | technique_scores | T1530 | Data from Cloud Storage |
Comments
The cloud service provider's default encryption setting for data stored and written to disk in the cloud may protect against adversary's attempt to access data from improperly secured cloud storage. This technique was rated as significant due to the high protect coverage factor.
References
|
| google_secops | Google Security Operations | technique_scores | T1530 | Data from Cloud Storage |
Comments
Google Security Ops is able to trigger an alert to notify personnel of GCP resources (e.g., storage buckets) that are publicly accessible to unauthenticated users.
This technique was scored as minimal based on low or uncertain detection coverage factor.
https://github.com/chronicle/detection-rules/blob/main/gcp_cloudaudit/gcp_gcs_public_accessible.yaral
References
|
| policy_intelligence | Policy Intelligence | technique_scores | T1530 | Data from Cloud Storage |
Comments
Policy Intelligence role recommendations generated by IAM Recommender can compare the permissions that each principal used during the past 90 days with the total permissions the principal has. This can be used to limit the permissions associated with creating and modifying platform images or containers that adversaries may try to access.
References
|
| policy_intelligence | Policy Intelligence | technique_scores | T1530 | Data from Cloud Storage |
Comments
Adversaries may attempt to implant cloud or container images with malicious code to gain access to an environment. The IAM audit logs can be used to receive data access and activity logs who has accessed to certain resources.
References
|
| security_command_center | Security Command Center | technique_scores | T1530 | Data from Cloud Storage |
Comments
SCC detect suspicious activity when accessing cloud storage objects (e.g., new IPs accessing storage objects or enumeration from unfamiliar user identities). Because of the real time temporal factor when detecting access to secure storage objects this control was graded as partial.
References
|
| sensitive_data_protection | Sensitive Data Protection | technique_scores | T1530 | Data from Cloud Storage |
Comments
This control is able to scan cloud storage objects for sensitive data and transform that data into a secure or nonsensitive form. It is able to scan for a variety of common sensitive data types, such as API keys, credentials, or credit card numbers. This control is able to be scheduled daily, weekly, etc and can scan new changes to data. This control is able to scan Google Cloud Storage, BigQuery tables, and Datastore.
References
|
| vpc_service_controls | VPC Service Controls | technique_scores | T1530 | Data from Cloud Storage |
Comments
This control may mitigate against access to cloud storage objects by limiting access to accounts and services contained within the VPC network perimeter that contains those cloud storage objects.
References
|