Adversaries may exfiltrate data by transferring the data, including backups of cloud environments, to another cloud account they control on the same service to avoid typical file transfers/downloads and network-based exfiltration detection.
A defender who is monitoring for large transfers to outside the cloud environment through normal file transfers or over command and control channels may not be watching for data transfers to another account within the same cloud provider. Such transfers may utilize existing cloud provider APIs and the internal address space of the cloud provider to blend into normal traffic or avoid data transfers over external network interfaces.
Incidents have been observed where adversaries have created backups of cloud instances and transferred them to separate accounts.[1]
| ID | Mitigation | Description |
|---|---|---|
| M1037 | Filter Network Traffic |
Implement network-based filtering restrictions to prohibit data transfers to untrusted VPCs. |
| M1027 | Password Policies |
Consider rotating access keys within a certain number of days to reduce the effectiveness of stolen credentials. |
| M1018 | User Account Management |
Limit user account and IAM policies to the least privileges required. Consider using temporary credentials for accounts that are only valid for a certain period of time to reduce the effectiveness of compromised accounts. |
| ID | Data Source | Data Component |
|---|---|---|
| DS0010 | Cloud Storage | Cloud Storage Creation |
| Cloud Storage Metadata | ||
| Cloud Storage Modification | ||
| DS0020 | Snapshot | Snapshot Creation |
| Snapshot Metadata | ||
| Snapshot Modification |
Monitor account activity for attempts to share data, snapshots, or backups with untrusted or unusual accounts on the same cloud service provider. Monitor for anomalous file transfer activity between accounts and to untrusted VPCs.
In AWS, sharing an Elastic Block Store (EBS) snapshot, either with specified users or publicly, generates a ModifySnapshotAttribute event in CloudTrail logs.[2] Similarly, in Azure, creating a Shared Access Signature (SAS) URI for a Virtual Hard Disk (VHS) snapshot generates a "Get Snapshot SAS URL" event in Activity Logs.[3][4]