T1530 — Data from Cloud Storage

# T1530 - Data from Cloud Storage

## SOC Recommendation
Investigate Data from Cloud Storage activity in the context of Collection: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Network Traffic Analysis | Detect | Monitor for Network Traffic Analysis indicators relevant to this technique. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Contain the affected host or account | Medium | No | Yes |
| Collect and preserve evidence | Low | Yes | No |

## KQL
```kql
AWSSecurityHubFindings
| where RecordState == "ACTIVE" and ComplianceStatus == "FAILED"
| where tostring(AwsSecurityFindingGeneratorId) == "security-control/SQS.3"
      or tostring(ComplianceSecurityControlId) == "SQS.3"
| mv-expand Resource = Resources
| where tostring(Resource.Type) == "AwsSqsQueue"
| extend QueueArn = tostring(Resource.Id)
| summarize TimeGenerated = max(TimeGenerated)
    by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription,
       AwsSecurityFindingId, ComplianceSecurityControlId, QueueArn
```
```kql
let highRisk = 3;
let business = 'Business Information';
CognniIncidents_CL 
| where Severity == highRisk
| where informationType_s == business
| where TimeGenerated >= ago(5h)
| extend AccountCustomEntity = userId_s
```
```kql
let highRisk = 3;
let financial = 'Financial Information';
CognniIncidents_CL 
| where Severity == highRisk
| where informationType_s == financial
| where TimeGenerated >= ago(5h)
| extend AccountCustomEntity = userId_s
```

## Escalation Criteria
- Data from Cloud Storage activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1530.json
• /api/recommendations/T1530.json
• /api/d3fend/T1530.json
• /api/mappings/T1530.json
• /api/confluence/T1530.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1530.json

Response:

{
  "technique_id": "T1530",
  "name": "Data from Cloud Storage",
  "priority": "high",
  "status": "draft",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Collection"
  ],
  "platforms": [
    "IaaS",
    "Office Suite",
    "SaaS"
  ],
  "summary": "Adversaries may access data from cloud storage. Many IaaS providers offer solutions for online data object storage such as Amazon S3, Azure Storage, and Google Cloud Storage...",
  "soc_recommendation": "Investigate Data from Cloud Storage activity in the context of Collection: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-NTA",
      "name": "Network Traffic Analysis",
      "relationship": "detect",
      "practical_action": "Monitor for Network Traffic Analysis indicators relevant to this technique.",
      "tooling": [
        "Sentinel",
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.",
      "Check Sentinel analytics rules and incidents correlated with this technique.",
      "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource."
    ],
    "generic": [
      "Confirm whether the observed data from cloud storage activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"AWS Security Hub - Detect SQS Queue policy allowing public access\" -- This query detects Amazon SQS queues with access policies that allow public (unauthenticated or cross-account unrestricted) access, using AWS Security Hub control SQS.3 findings. Publicly accessible queues can enable data exfiltration, unauthorized message injection, or disruption of workflows."
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Contain the affected host or account",
      "category": "Containment",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "Defender for Endpoint / Entra ID",
      "notes": "Requires approval -- confirm malicious intent before isolating a host or disabling an account."
    },
    {
      "name": "Collect and preserve evidence",
      "category": "Investigation",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "Defender for Endpoint",
      "notes": "Safe -- read-only evidence collection."
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "4f0f3c2a-8d44-43f8-9d9a-5b1e0d5f2c11 — AWS Security Hub - Detect SQS Queue policy allowing public access",
        "description": "This query detects Amazon SQS queues with access policies that allow public (unauthenticated or cross-account unrestricted) access, using AWS Security Hub control SQS.3 findings. Publicly accessible queues can enable data exfiltration, unauthorized message injection, or disruption of workflows. (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "AWSSecurityHubFindings\n| where RecordState == \"ACTIVE\" and ComplianceStatus == \"FAILED\"\n| where tostring(AwsSecurityFindingGeneratorId) == \"security-control/SQS.3\"\n      or tostring(ComplianceSecurityControlId) == \"SQS.3\"\n| mv-expand Resource = Resources\n| where tostring(Resource.Type) == \"AwsSqsQueue\"\n| extend QueueArn = tostring(Resource.Id)\n| summarize TimeGenerated = max(TimeGenerated)\n    by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription,\n       AwsSecurityFindingId, ComplianceSecurityControlId, QueueArn"
      },
      {
        "name": "44e80f00-b4f5-486b-a57d-4073746276df — Cognni Incidents for Highly Sensitive Business Information",
        "description": "Display incidents in which highly sensitive business information was placed at risk by user sharing.' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "let highRisk = 3;\nlet business = 'Business Information';\nCognniIncidents_CL \n| where Severity == highRisk\n| where informationType_s == business\n| where TimeGenerated >= ago(5h)\n| extend AccountCustomEntity = userId_s"
      },
      {
        "name": "7ebb7386-6c99-4331-aab1-a185a603eb47 — Cognni Incidents for Highly Sensitive Financial Information",
        "description": "Display incidents in which highly sensitive financial information was placed at risk by user sharing.' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "let highRisk = 3;\nlet financial = 'Financial Information';\nCognniIncidents_CL \n| where Severity == highRisk\n| where informationType_s == financial\n| where TimeGenerated >= ago(5h)\n| extend AccountCustomEntity = userId_s"
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "220d92c6-479d-4a49-9cc0-3a29756dad0c — Kubernetes Secret or ConfigMap Access via Azure Arc Proxy",
        "description": "(ESQL) Detects when secrets or configmaps are accessed, created, modified, or deleted in a Kubernetes cluster by the Azure Arc AAD proxy service account. When operations are routed through the Azure Arc Cluster Connect proxy, the Kubernetes audit log records the acting user as `system:serviceaccount:azure-arc:azure-arc-kube-aad-proxy-sa` with the actual caller identity in the `impersonatedUser` field... (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "FROM logs-kubernetes.audit_logs-* metadata _id, _version, _index\n| WHERE STARTS_WITH(kubernetes.audit.user.username, \"system:serviceaccount:azure-arc:\")\n    AND kubernetes.audit.objectRef.resource IN (\"secrets\", \"configmaps\")\n    AND kubernetes.audit.verb IN (\"get\", \"list\", \"create\", \"update\", \"patch\", \"delete\")\n    AND kubernetes.audit.objectRef.namespace NOT IN (\"azure-arc\", \"azure-arc-release\", \"kube-system\")\n    AND NOT STARTS_WITH(kubernetes.audit.objectRef.name, \"sh.helm.release.v1\")\n\n| STATS\n    Esql.verb_values = VALUES(kubernetes.audit.verb),\n    Esql.resource_type_values = VALUES(kubernetes.audit.objectRef.resource),\n    Esql.resource_name_values = VALUES(kubernetes.audit.objectRef.name),\n    Esql.namespace_values = VALUES(kubernetes.audit.objectRef.namespace),\n    Esql.acting_user_values = VALUES(kubernetes.audit.user.username),\n    Esql.user_agent_values = VALUES(kubernetes.audit.userAgent),\n    Esql.source_ips_values = VALUES(kubernetes.audit.sourceIPs),\n    Esql.response_code_values = VALUES(kubernetes.audit.responseStatus.code),\n    Esql.timestamp_first_seen = MIN(@timestamp),\n    Esql.timestamp_last_seen = MAX(@timestamp),\n    Esql.event_count = COUNT(*)\n    BY kubernetes.audit.impersonatedUser.username\n\n| WHERE Esql.timestamp_first_seen >= NOW() - 9 minutes\n| KEEP *"
      },
      {
        "name": "0e524fa6-eed3-11ef-82b4-f661ea17fbce — M365 OneDrive/SharePoint Excessive File Downloads",
        "description": "(ESQL) Identifies when an excessive number of files are downloaded from OneDrive or SharePoint by an authorized user or application in a short period of time. This may indicate a potential data exfiltration event, especially if the downloads are performed using OAuth authentication which could suggest an OAuth phishing attack such as Device Code Authentication phishing. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "from logs-o365.audit-* metadata _id, _version, _index\n| where\n    data_stream.dataset == \"o365.audit\" and\n    event.provider == \"OneDrive\" and\n    event.action == \"FileDownloaded\" and\n    event.outcome == \"success\"\n    and (user.id is not null and o365.audit.ApplicationId is not null)\n    and o365.audit.ApplicationId not in (\n        \"08e18876-6177-487e-b8b5-cf950c1e598c\", // SharePoint Online Web Client Extensibility\n        \"fb8d773d-7ef8-4ec0-a117-179f88add510\", // Enterprise Copilot Platform\n        \"d3590ed6-52b3-4102-aeff-aad2292ab01c\", // Microsoft Office\n        \"7ab7862c-4c57-491e-8a45-d52a7e023983\" // App Service\n    )\n| eval session.id = coalesce(o365.audit.AppAccessContext.AADSessionId, session.id, null)\n| where session.id is not null\n| eval Esql.time_window_date_trunc = date_trunc(3 minutes, @timestamp)\n| stats\n    Esql.file_directory_values = values(file.directory),\n    Esql.file_extension_values = values(file.extension),\n    Esql.application_name_values = values(application.name),\n    Esql.file_name_count_distinct = count_distinct(file.name),\n    Esql.total_file_size_mb = round((mv_sum(values(file.size))) / 1048576.0, 2),\n    Esql.o365_audit_Site_values = values(o365.audit.Site),\n    Esql.o365_audit_SiteUrl_values = values(o365.audit.SiteUrl),\n    Esql.user_domain_values = values(user.domain),\n    Esql.token_id_values = values(token.id),\n    Esql.event_code_values = values(event.code),\n    Esql.event_provider_values = values(event.provider),\n    Esql.auth_type_values = values(o365.audit.AuthenticationType),\n    Esql.is_managed_device_values = values(o365.audit.IsManagedDevice),\n    Esql.platform_values = values(o365.audit.Platform),\n    Esql.user_agent_values = values(user_agent.name),\n    Esql.source_asn_org_values = values(source.as.organization.name),\n    Esql.geo_country_values = values(source.geo.country_name),\n    Esql.event_count = count(*)\n    by\n    Esql.time_window_date_trunc,\n    user.id,\n    session.id,\n    source.ip,\n    o365.audit.ApplicationId\n| where Esql.file_name_count_distinct >= 25\n| keep\n    Esql.*,\n    user.id,\n    source.ip,\n    o365.audit.ApplicationId,\n    session.id"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Data from Cloud Storage activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate administrative or maintenance activity matching this pattern.",
    "Approved security testing or red team exercise.",
    "Known benign software producing similar telemetry."
  ],
  "confluence": {
    "title": "T1530 - Data from Cloud Storage Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}