adpare
82 lines
5.0 KiB
JSON
82 lines
5.0 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--dece3612-af26-43a8-8a19-c42a2923b688",
|
|
"spec_version": "2.0",
|
|
"objects": [
|
|
{
|
|
"type": "attack-pattern",
|
|
"id": "attack-pattern--d4bdbdea-eaec-4071-b4f9-5105e12ea4b6",
|
|
"created": "2019-08-30T13:03:04.038Z",
|
|
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
|
|
"revoked": false,
|
|
"external_references": [
|
|
{
|
|
"source_name": "mitre-attack",
|
|
"url": "https://attack.mitre.org/techniques/T1537",
|
|
"external_id": "T1537"
|
|
},
|
|
{
|
|
"source_name": "AWS EBS Snapshot Sharing",
|
|
"description": "Amazon Web Services. (n.d.). Share an Amazon EBS snapshot. Retrieved March 2, 2022.",
|
|
"url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-modifying-snapshot-permissions.html"
|
|
},
|
|
{
|
|
"source_name": "TLDRSec AWS Attacks",
|
|
"description": "Clint Gibler and Scott Piper. (2021, January 4). Lesser Known Techniques for Attacking AWS Environments. Retrieved March 4, 2024.",
|
|
"url": "https://tldrsec.com/p/blog-lesser-known-aws-attacks"
|
|
},
|
|
{
|
|
"source_name": "Azure Shared Access Signature",
|
|
"description": "Delegate access with a shared access signature. (2019, December 18). Delegate access with a shared access signature. Retrieved March 2, 2022.",
|
|
"url": "https://docs.microsoft.com/en-us/rest/api/storageservices/delegate-access-with-shared-access-signature"
|
|
},
|
|
{
|
|
"source_name": "Azure Blob Snapshots",
|
|
"description": "Microsoft Azure. (2021, December 29). Blob snapshots. Retrieved March 2, 2022.",
|
|
"url": "https://docs.microsoft.com/en-us/azure/storage/blobs/snapshots-overview"
|
|
},
|
|
{
|
|
"source_name": "Microsoft Azure Storage Shared Access Signature",
|
|
"description": "Microsoft. (2023, June 7). Grant limited access to Azure Storage resources using shared access signatures (SAS). Retrieved March 4, 2024.",
|
|
"url": "https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview"
|
|
},
|
|
{
|
|
"source_name": "DOJ GRU Indictment Jul 2018",
|
|
"description": "Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved November 17, 2024.",
|
|
"url": "https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
|
|
],
|
|
"modified": "2025-10-24T17:49:27.409Z",
|
|
"name": "Transfer Data to Cloud Account",
|
|
"description": "Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service.\n\nA defender who is monitoring for large transfers to outside the cloud environment through normal file transfers or over command and control channels may not be watching for data transfers to another account within the same cloud provider. Such transfers may utilize existing cloud provider APIs and the internal address space of the cloud provider to blend into normal traffic or avoid data transfers over external network interfaces.(Citation: TLDRSec AWS Attacks)\n\nAdversaries may also use cloud-native mechanisms to share victim data with adversary-controlled cloud accounts, such as creating anonymous file sharing links or, in Azure, a shared access signature (SAS) URI.(Citation: Microsoft Azure Storage Shared Access Signature)\n\nIncidents have been observed where adversaries have created backups of cloud instances and transferred them to separate accounts.(Citation: DOJ GRU Indictment Jul 2018) ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "exfiltration"
|
|
}
|
|
],
|
|
"x_mitre_attack_spec_version": "3.2.0",
|
|
"x_mitre_contributors": [
|
|
"Praetorian",
|
|
"Darin Smith, Cisco",
|
|
"ExtraHop",
|
|
"Gabriel Currie"
|
|
],
|
|
"x_mitre_deprecated": false,
|
|
"x_mitre_domains": [
|
|
"enterprise-attack"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
|
|
"x_mitre_platforms": [
|
|
"IaaS",
|
|
"Office Suite",
|
|
"SaaS"
|
|
],
|
|
"x_mitre_version": "1.5"
|
|
}
|
|
]
|
|
} |