GCP bigquery.jobs.insert
Creates and submits a BigQuery job (query, load, export, or copy) that accesses or transforms data in BigQuery datasets.
T1537: Transfer Data to Cloud Account
T1537: Transfer Data to Cloud Account
Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service. A defender who is monitoring for large transfers to outside the cloud environment through normal file ...
View on MITRE ATT&CK →GCP cloudsql.instances.export
Exports data from a Cloud SQL instance to a Cloud Storage bucket.
Azure CopyBlob
Copies a blob within or between Azure Storage accounts or containers.
AWS CopyObject
Copies an object from one S3 location to another, within or across buckets, optionally modifying metadata or encryption.
AWS CreateDBSnapshot
Creates a manual point-in-time snapshot of an RDS database instance for backup or recovery purposes.
AWS CreateImage
Creates an Amazon Machine Image (AMI) from a running or stopped EC2 instance, capturing its disk state for reuse.
AWS CreateInstanceExportTask
Exports an EC2 instance as a virtual machine image to an S3 bucket in a format such as OVF or VMDK.
AWS CreateSnapshot
Creates a point-in-time snapshot of an EBS volume, stored durably for backup or volume duplication.
AWS GetObject
Retrieves (downloads) an object from an S3 bucket; logged in CloudTrail only when S3 data events are enabled.
Azure Microsoft.Compute/disks/beginGetAccess/action
Generates a time-limited SAS URL to access or download the data of an Azure managed disk.
Azure Microsoft.Compute/snapshots/beginGetAccess/action
Generates a time-limited SAS URL to access or download the data from an Azure VM disk snapshot.
Azure Microsoft.Sql/servers/databases/export/action
Exports an Azure SQL Database to a BACPAC file stored in Azure Blob Storage.
AWS ModifyDBSnapshotAttribute
Modifies the attributes of an RDS DB snapshot, such as sharing it with other AWS accounts.
AWS ModifyImageAttribute
Modifies attributes of an AMI, such as making it public or sharing it with specific AWS accounts.
AWS ModifySnapshotAttribute
Modifies the permissions of an EBS snapshot, such as making it public or sharing it with specific AWS accounts.
AWS PutBucketReplication
Enables replication for an S3 bucket, automatically copying objects to a destination bucket in the same or another region.
AWS SharedSnapshotCopyInitiated
Records the start of a copy operation for an EBS snapshot shared from another AWS account.
AWS SharedSnapshotVolumeCreated
Records the creation of an EBS volume from a snapshot shared by another AWS account.
AWS StartExportTask
Starts an export of an RDS snapshot to Amazon S3 in Apache Parquet format for use in analytics.