Exfiltration over web service / cloud account

Uploads to legitimate services or attacker cloud storage

categoryNetwork and infrastructure attacksseverityHighdetectabilityHighlabnot yet measured

Example: MEGA.NZ

Classification

37 values: 13 reviewed, 23 imported, 1 derived. What do these mean?

Exploitability

Attack vector	Network attacks
Reach (CVSS)	Network
Attack complexity	Low
Privileges required	Low
User interaction	None
Attacker skill required	Low
Resources required	Low
Likelihood / prevalence	High
Maturity	Commoditized

Impact & scope

Severity	High
Impact	Confidentiality
Platform	ESXiIaaSLinuxmacOSOffice SuiteSaaSWindows
Environment	CloudOn-premises
Target asset class	Data store
Kill-chain phase (tactic)	Exfiltration

Detection & telemetry

Detectability	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Application Log ContentCloud Storage MetadataCloud Storage ModificationCommand ExecutionFile AccessFile CreationNetwork Connection CreationNetwork Traffic ContentNetwork Traffic FlowProcess CreationSnapshot CreationSnapshot MetadataSnapshot Modification

Detection & response

Mitigated by 16

M1018 attack-mitigation
M1021 attack-mitigation
M1037 attack-mitigation
M1054 attack-mitigation
M1057 attack-mitigation
D3-APCA d3fend
D3-CSPP d3fend
D3-NTCD d3fend
D3-NTF d3fend
D3-NTSA d3fend
D3-OTF d3fend
D3-PHDURA d3fend
D3-PMAD d3fend
D3-RPA d3fend
D3-RTSD d3fend
D3-UGLPA d3fend

Detected by 36

DET0548 attack-detection-strategy
DET0573 attack-detection-strategy
00b90cc1-17ec-402c-96ad-3a8117d7a582 sigma
00bca14a-df4e-4649-9054-3f2aa676bc04 sigma
04ad83ef-1a37-4c10-b57a-81092164bf33 sigma
065cceea-77ec-4030-9052-fc0affea7110 sigma
090ffaad-c01a-4879-850c-6d57da98452d sigma
0c46d4f4-a2bf-4104-9597-8d653fc2bb55 sigma
18249279-932f-45e2-b37a-8925f2597670 sigma
19bf6fdb-7721-4f3d-867f-53467f6a5db6 sigma
1cbbeaaf-3c8c-4e4c-9d72-49485b6a176b sigma
1d08ac94-400d-4469-a82f-daee9a908849 sigma
1f0f6176-6482-4027-b151-00071af39d7e sigma
25eabf56-22f0-4915-a1ed-056b8dae0a68 sigma
29f171d7-aa47-42c7-9c7b-3c87938164d9 sigma
2b669496-d215-47d8-bd9a-f4a45bf07cda sigma
2c03648b-e081-41a5-b9fb-7d854a915091 sigma
34986307-b7f4-49be-92f3-e7a4d01ac5db sigma
4b657234-038e-4ad5-997c-4be42340bce4 sigma
54b9a76a-3c71-4673-b4b3-2edb4566ea7b sigma
5ba715b6-71b7-44fd-8245-f66893e81b3d sigma
613c03ba-0779-4a53-8a1f-47f914a4ded3 sigma
66474410-b883-415f-9f8d-75345a0a66a6 sigma
69b3bd1e-b38a-462f-9a23-fbdbf63d2294 sigma
6ddff2e8-ea1a-45d0-8938-93dfc1d67ae7 sigma
78b3756a-7804-4ef7-8555-7b9024a02e2d sigma
7cd1dcdc-6edf-4896-86dc-d1f19ad64903 sigma
9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4 sigma
9e02c8ec-02b9-43e8-81eb-34a475ba7965 sigma
abae8fec-57bd-4f87-aff6-6e3db989843d sigma
b593fd50-7335-4682-a36c-4edcb68e4641 sigma
c3dbbc9f-ef1d-470a-a90a-d343448d5875 sigma
e290b10b-1023-4452-a4a9-eb31a9013b3a sigma
e328cc73-f92a-42fb-b3fa-7c2cffda981a sigma
e37db05d-d1f9-49c8-b464-cee1a4b11638 sigma
fdeebdf0-9f3f-4d08-84a6-4c4d13e39fe4 sigma

Tested by 7

35ad6590-2207-4b14-bf8f-9899470d7156 atomic
40c44d16-bb49-4d14-aafa-f9ba7e6e6c5b atomic
8529ee44-279a-4a19-80bf-b846a40dda58 atomic
a4b74723-5cee-4300-91c3-5e34166909b4 atomic
c2e8ab6e-431e-460a-a2aa-3bc6a32022e3 atomic
c666acd6-6ff5-4d28-9490-195d89cd4337 atomic
f0057c81-24dc-4a2e-b658-5809c242180b atomic

Framework references

Primary source: https://attack.mitre.org/tactics/TA0010/
attack: T1567 (primary)
attack: T1537

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Network and infrastructure attacks' table, line 210 of Cyber-Attack-Taxonomy.md
ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 16 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 3 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)