CopyObject

CSP: AWS

Tactics:

Collection Exfiltration

Techniques:

T1530T1537

Tags:

AWS S3

Event

Copies an object from one S3 location to another, within or across buckets, optionally modifying metadata or encryption.

Security Context

• Accessing cloud storage objects can expose sensitive data including backups, configuration files, application data, and customer information.
• Transferring data to external cloud accounts or regions can bypass network-based data loss prevention controls and exfiltrate large volumes of data.

Log Source

CloudTrail

Sample Event

MITRE ATT&CK Mapping

Tactics: Collection Exfiltration

Techniques:

• T1530 — Data from Cloud Storage — Adversaries may access data from cloud storage. Many IaaS providers offer solutions for online data object storage such as Amazon S3, Azure Storage, and Google Cloud Storage.
• T1537 — Transfer Data to Cloud Account — Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service. A defender who is monitoring for large transfers to outside the cloud environment through normal file ...