# T1537 - Transfer Data to Cloud Account

## SOC Recommendation
Investigate Transfer Data to Cloud Account activity in the context of Exfiltration: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Network Traffic Analysis | Detect | Monitor for Network Traffic Analysis indicators relevant to this technique. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Block personal cloud storage services at network egress (pro | Medium | No | Yes |
| Suspend account access | Low | No | Yes |
| Notify HR and Legal — preserve evidence for proceedings | Low | Yes | No |
| Assess data sensitivity and breach notification obligations | Low | No | Yes |

## KQL
```kql
let PersonalCloud = dynamic([
    "dropbox.com", "dropboxapi.com", "content.dropboxapi.com",
    "drive.google.com",
    "mega.nz", "mega.co.nz",
    "wetransfer.com", "we.tl",
    "box.com", "upload.box.com",
    "onedrive.live.com", "storage.live.com",
    "mediafire.com", "sendspace.com", "gofile.io",
    "file.io", "transfer.sh", "anonfiles.com",
    "raw.githubusercontent.com", "gist.github.com", "paste.ee", "pastebin.com"
]);
DeviceNetworkEvents
| where TimeGenerated >= ago(1h)
| where RemoteUrl has_any (PersonalCloud)
| summarize
    Sessions = count(),
    DestDomains = make_set(RemoteUrl, 5)
    by DeviceName, InitiatingProcessFileName
| where Sessions > 10
| extend timestamp = now(), HostCustomEntity = DeviceName
| order by Sessions desc
```
```kql
// High severity - Social and Public Exposure - Exposure of PII/CII in Public Domain
let timeFrame = 5m;
CyfirmaSPEPIIAndCIIAlerts_CL
| where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())
| extend
    Description=description,
    FirstSeen=first_seen,
    LastSeen=last_seen,
    RiskScore=risk_score,
    AlertUID=alert_uid,
    UID=uid,
    AssetType=asset_type,
    AssetValue=signature,
    Source=source,
    Impact=impact,
    Recommendation=recommendation,
    PostedDate=posted_date,
    ProviderName='CYFIRMA',
    ProductName='DeCYFIR/DeTCT',
    AlertTitle=Alert_title
| project
    TimeGenerated,
    Description,
    RiskScore,
    FirstSeen,
    LastSeen,
    AlertUID,
    UID,
    AssetType,
    AssetValue,
    Source,
    Impact,
    Recommendation,
    PostedDate,
    ProductName,
    ProviderName,
    AlertTitle
```
```kql
TheomAlerts_CL
 | where priority_s == "P1"
```

## Escalation Criteria
- Transfer Data to Cloud Account activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.