Microsoft.Sql/servers/databases/export/action

CSP: Azure

Tactics:

Exfiltration Collection

Techniques:

T1537T1530

Tags:

Azure Azure SQL

Event

Exports an Azure SQL Database to a BACPAC file stored in Azure Blob Storage.

Security Context

• Accessing cloud storage objects can expose sensitive data including backups, configuration files, application data, and customer information.
• Transferring data to external cloud accounts or regions can bypass network-based data loss prevention controls and exfiltrate large volumes of data.

Log Source

Azure Activity Log

Sample Event

MITRE ATT&CK Mapping

Tactics: Exfiltration Collection

Techniques:

• T1537 — Transfer Data to Cloud Account — Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service. A defender who is monitoring for large transfers to outside the cloud environment through normal file ...
• T1530 — Data from Cloud Storage — Adversaries may access data from cloud storage. Many IaaS providers offer solutions for online data object storage such as Amazon S3, Azure Storage, and Google Cloud Storage.