T1530 Data from Cloud Storage — Detection & Response
Adversaries may access data objects from improperly secured cloud storage. Many cloud service providers offer solutions for online data object storage such as Amazon S3, Azure Blob storage, and Google Cloud Storage. These solutions differ from other storage solutions in that data can be accessed via native web protocols.
Coverage at a glance
- Detections shipped
- 4
- Avg. verdict time
- < 5 min
- Data sources
- 2+
Threat context
How adversaries use T1530 Data from Cloud Storage — Detection & Response
Adversaries may access data objects from improperly secured cloud storage. Many cloud service providers offer solutions for online data object storage such as Amazon S3, Azure Blob storage, and Google Cloud Storage. These solutions differ from other storage solutions in that data can be accessed via native web protocols.
Publicly exposed S3 buckets, Azure Blob containers, and GCS buckets are a frequent source of data breaches. Attackers actively scan for misconfigured cloud storage using tools like truffleHog, bucket-finder, and specialised scanners. Insiders with legitimate cloud credentials may exfiltrate large datasets from cloud storage by copying objects to personal accounts or downloading directly. Ransomware groups exfiltrate from cloud storage as part of double-extortion before encrypting on-premises systems.
Detections ManySignal ships
Ready-to-deploy detection rules
| Rule name | Severity | Data source |
|---|---|---|
| Public S3 Bucket Access — GetObject from unauthenticated principal S3 bucket accessed by an unauthenticated (public) principal, indicating bucket misconfiguration. | High | AWS CloudTrail / S3 Access Logs |
| Mass S3 Download — High volume GetObject calls by single principal in short window A single IAM principal downloads an unusually large number of S3 objects in a short time, consistent with data exfiltration. | High | AWS CloudTrail |
| Cross-Account S3 Copy — CopyObject to a bucket in a different AWS account Data is copied from an internal S3 bucket to a bucket in an external AWS account, a common exfiltration pattern. | High | AWS CloudTrail |
| S3 Bucket ACL Set to Public — PutBucketAcl making bucket publicly accessible An S3 bucket's ACL is modified to allow public read access, potentially exposing sensitive data. | Critical | AWS CloudTrail |
Related techniques and tactics
T1078 Valid Accounts — Detection & Response
ATT&CK Technique
T1110 Brute Force — Detection & Response
ATT&CK Technique
T1566 Phishing — Detection & Response
ATT&CK Technique
T1059 Command and Scripting Interpreter — Detection & Response
ATT&CK Technique
T1053 Scheduled Task/Job — Detection & Response
ATT&CK Technique
T1548 Abuse Elevation Control Mechanism — Detection & Response
ATT&CK Technique
T1068 Exploitation for Privilege Escalation — Detection & Response
ATT&CK Technique
T1134 Access Token Manipulation — Detection & Response
ATT&CK Technique
T1098 Account Manipulation — Detection & Response
ATT&CK Technique
T1136 Create Account — Detection & Response
ATT&CK Technique
T1556 Modify Authentication Process — Detection & Response
ATT&CK Technique
T1621 Multi-Factor Authentication Request Generation — Detection & Response
ATT&CK Technique
T1530 Data from Cloud Storage — Detection & Response: frequently asked questions
How does ManySignal differentiate legitimate bulk S3 access from exfiltration?
ManySignal baselines S3 access patterns per IAM principal: average daily object count, typical bucket scope, and typical request time. A spike beyond the principal's normal pattern — particularly to unusual buckets or at unusual times — generates an alert. Cross-account copies and downloads to known egress IPs are always high-priority signals.
See the agentic SOC in action
Watch AI agents work a real alert queue — verdicts, evidence, and confidence scores included. In-house SOC or MDR, your call.