Transfer Data to Cloud Account (T1537) is an Exfiltration technique. Adversaries move data to another cloud account they control on the same service, through sharing, syncing or backups. MITRE lists IaaS, Office Suite and SaaS.
How attackers use it
The trick is the route. A defender watching for large transfers out of the cloud environment, or over command and control channels, may not be watching transfers to another account within the same provider. MITRE says such transfers can use existing cloud provider APIs and the provider's internal address space, so they blend into normal traffic and avoid external network interfaces.
Adversaries may also use native sharing mechanisms: anonymous file sharing links, or in Azure a shared access signature (SAS) URI. MITRE notes incidents where adversaries created backups of cloud instances and moved them to separate accounts.
How to detect it
MITRE's analytics, by area:
- Infrastructure: snapshot sharing, backup exports or object transfers from your accounts to other cloud identities on the same provider, including snapshot sharing, bucket policy updates and SAS URI generation.
- File platforms: files shared or synced with external domains through link generation, external sharing in OneDrive, or transfers involving partner tenants that are not on an approved list.
- SaaS: built in sharing used to hand ownership or access of critical data to external tenants or untrusted users through API calls or link creation.
Alert on snapshot or image permission changes that name an outside account, new bucket policies that grant access to an unknown principal, newly created anonymous links, and shares to domains that are not allowlisted.
How to reduce the risk
MITRE lists four mitigations:
- Data Loss Prevention: block sensitive data from being shared with people outside the organization.
- User Account Management: limit user account and IAM policies to least privilege.
- Software Configuration: set data sharing limits in cloud services. External sharing in SharePoint and Google Drive can be turned off, blocked for certain domains or restricted to certain users.
- Filter Network Traffic: use network filtering to prohibit data transfers to untrusted VPCs.
Check your own environment
A read only AWS CLI check for who a snapshot is shared with (replace the snapshot ID):
aws ec2 describe-snapshot-attribute --snapshot-id snap-0123456789abcdef0 --attribute createVolumePermission
Also confirm:
- Which accounts are allowed to receive shared snapshots, images or buckets?
- Is external sharing in your file platforms limited to approved domains?
- Do you alert on permission changes that mention an unknown account ID?
Quick check
Why can this exfiltration escape monitoring?
The data moves between accounts inside the same provider using internal cloud APIs and address space, so tools that watch for traffic leaving the environment may never see it.
