Cloud storage is where legitimate files go, so it is also where stolen files can go. MITRE T1567.002, Exfiltration to Cloud Storage, covers data sent to such services instead of over the main command and control channel. It applies to ESXi, Linux, macOS and Windows.
How attackers use it
Cloud storage services allow data to be stored, edited and retrieved over the Internet. MITRE names Dropbox and Google Docs as examples. If hosts in the network already communicate with the service, the traffic offers significant cover.
How to detect it
MITRE's analytics describe chains of file access and upload:
- Windows: processes such as powershell.exe or excel.exe reading large local files and then making HTTPS POST requests to storage domains such as dropbox.com, drive.google.com or box.com, with high outbound volume.
- Linux:
curl,wget,rcloneor custom scripts uploading, often aftertarorgzipcompresses the files, using HTTPS PUT or POST to storage endpoints. - macOS: storage clients such as Dropbox sync, iCloud or Google Drive in unexpected contexts, or sensitive file reads by non-standard apps followed by encrypted uploads.
- ESXi: vmx or hostd reading datastore files and sending outbound HTTPS traffic to storage endpoints.
Per-process, per-user upload volume against a baseline is the most useful number.
How to reduce the risk
MITRE lists restricting web-based content: use web proxies to enforce an external network communication policy that prevents unauthorized external services. In practice, permit the corporate tenant of your approved storage service and block personal tenants, and keep server networks away from consumer storage entirely.
Check your own environment
- List which cloud storage domains are reachable from servers, and who approved that.
- Check whether you can separate corporate from personal accounts of the same service in logs.
- Look for tools like rclone on hosts where nobody should need them. On Linux:
command -v rclone
ps -eo pid,user,etime,cmd | grep -i rclone
Quick check
Which command chain does MITRE call out on Linux?
Files compressed with tar or gzip, followed by an HTTPS PUT or POST upload to a storage endpoint using curl, wget, rclone or a script.
