Synopsis
Activation Period |
14 Days |
Training Period |
30 Days |
Test Period |
1 Hour |
Deduplication Period |
1 Day |
Required Data |
|
Detection Modules |
Cloud |
Detector Tags |
Cloud Data Asset Exfiltration |
ATT&CK Tactic |
|
ATT&CK Technique |
|
Severity |
Informational |
Description
An identity initiated a download of multiple cloud objects.
This might be an indication for an adversary trying to exfiltrate data from cloud storage.
Attacker's Goals
Exfiltrate data from the cloud environment.
Investigative actions
Check the identity which invoked the operations.
Check the accessed resource and verify it doesn't contain sensitive data.
Variations
An identity initiated a download of multiple cloud objects in large volume compared to the project's usual volumeAn identity initiated a download of multiple cloud objects in large volume compared to the bucket's usual volume