T1530

Data from Cloud Storage

Collection Last updated:

Adversaries access data from cloud storage services including IaaS object stores (Amazon S3, Azure Blob Storage, Google Cloud Storage) and SaaS platform storage (OneDrive, SharePoint, Google Drive, Dropbox). Attack vectors include exploiting misconfigured public bucket access, using compromised credentials or SAS tokens, abusing overly permissive IAM roles, and automated tools such as Rclone, Pacu, and AADInternals for bulk extraction. Threat actors observed using this technique include Fox Kitten, APT42, HAFNIUM, Scattered Spider, and Storm-0501 — the latter specifically modifying Azure Storage account configurations to expose non-remotely accessible accounts for data exfiltration. Misconfigurations enabling anonymous or overly broad access have led to exposure of PII, medical records, and financial data at scale.

What is T1530 Data from Cloud Storage?

Data from Cloud Storage (T1530) maps to the Collection tactic — the adversary is trying to gather data of interest to their goal in MITRE ATT&CK.

This page provides production-ready detection logic for Data from Cloud Storage, covering the data sources and telemetry it touches: Cloud Storage: Cloud Storage Access, Application Log: Application Log Content, Microsoft 365 Unified Audit Logs, Azure Storage Diagnostic Logs, Azure Activity Logs. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Collection
Technique
T1530 Data from Cloud Storage
Canonical reference
https://attack.mitre.org/techniques/T1530/
Microsoft Sentinel / Defender
kusto 
let MassDownloadThreshold = 50;
let BulkTimeWindow = 30m;
// Pattern 1: OneDrive/SharePoint mass file downloads (AADInternals, Scattered Spider pattern)
let OneDriveAlert = OfficeActivity
| where TimeGenerated > ago(24h)
| where OfficeWorkload in ("OneDrive", "SharePoint")
| where Operation in ("FileDownloaded", "FileSyncDownloadedFull", "FileAccessed", "FileCopied")
| summarize
    FileCount = count(),
    UniqueFiles = dcount(SourceFileName),
    SiteUrls = make_set(SiteUrl, 5),
    Operations = make_set(Operation),
    UserAgentSample = take_any(UserAgent)
    by UserId, ClientIP, bin(TimeGenerated, BulkTimeWindow)
| where FileCount > MassDownloadThreshold
| extend
    AlertType = "OneDrive_MassDownload",
    Platform = "Microsoft365",
    Severity = iff(FileCount > 300, "High", "Medium"),
    Details = strcat(tostring(FileCount), " files from ", tostring(array_length(SiteUrls)), " site(s)")
| project TimeGenerated, UserId, ClientIP, AlertType, Platform, Severity,
          FileCount, UniqueFiles, Details, UserAgentSample;
// Pattern 2: Azure Blob Storage anonymous access or bulk download
let BlobAlert = StorageBlobLogs
| where TimeGenerated > ago(24h)
| where OperationName in ("GetBlob", "ListBlobs", "ListBlobsHierarchySegment",
                          "GetBlobProperties", "GetContainerProperties")
| where StatusCode == 200
| extend IsAnonymous = toint(AuthenticationType =~ "Anonymous")
| summarize
    RequestCount = count(),
    TotalBytes = sum(tolong(ResponseBodySize)),
    UniqueObjects = dcount(Uri),
    AnonRequests = sum(IsAnonymous),
    OperationTypes = make_set(OperationName)
    by AccountName, CallerIpAddress, AuthenticationType, bin(TimeGenerated, BulkTimeWindow)
| where RequestCount > MassDownloadThreshold or AnonRequests > 0
| extend
    AlertType = iff(AnonRequests > 0, "AzureBlob_AnonymousAccess", "AzureBlob_BulkDownload"),
    Platform = "AzureStorage",
    Severity = iff(AnonRequests > 0 or TotalBytes > 1073741824, "High", "Medium"),
    Details = strcat(tostring(RequestCount), " requests, ", tostring(TotalBytes / 1048576), " MB transferred")
| project TimeGenerated, UserId=AccountName, ClientIP=CallerIpAddress,
          AlertType, Platform, Severity, FileCount=RequestCount,
          UniqueFiles=UniqueObjects, Details, UserAgentSample=AuthenticationType;
// Pattern 3: Azure Storage key listing or permission change (Storm-0501 exfil staging)
let StorageConfigAlert = AzureActivity
| where TimeGenerated > ago(24h)
| where ResourceProviderValue =~ "MICROSOFT.STORAGE"
| where OperationNameValue in (
    "MICROSOFT.STORAGE/STORAGEACCOUNTS/WRITE",
    "MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/WRITE",
    "MICROSOFT.STORAGE/STORAGEACCOUNTS/LISTKEYS/ACTION",
    "MICROSOFT.STORAGE/STORAGEACCOUNTS/REGENERATEKEY/ACTION"
    )
| where ActivityStatusValue =~ "Success"
| extend
    AlertType = "AzureStorage_SuspiciousConfigChange",
    Platform = "Azure",
    Severity = "High",
    Details = OperationNameValue
| project TimeGenerated, UserId=Caller, ClientIP=CallerIpAddress,
          AlertType, Platform, Severity, FileCount=int(null),
          UniqueFiles=int(null), Details, UserAgentSample="AzureRM";
// Union all patterns
union kind=outer OneDriveAlert, BlobAlert, StorageConfigAlert
| sort by TimeGenerated desc

Detects cloud storage data collection across three attack patterns seen in threat actor campaigns. Pattern 1 uses OfficeActivity to identify mass OneDrive or SharePoint file access exceeding 50 operations in 30 minutes, consistent with AADInternals and Scattered Spider bulk extraction activity. Pattern 2 uses Azure Storage diagnostic logs (StorageBlobLogs) to detect anonymous blob access or high-volume download operations against Azure Blob containers. Pattern 3 monitors AzureActivity for storage account key listing and permission changes that match Storm-0501's technique of exposing storage accounts for remote exfiltration. Requires Microsoft 365 Unified Audit Logs, Azure Activity Logs, and Azure Storage diagnostic logs all forwarded to the Log Analytics workspace.

high severity medium confidence

Data Sources

Cloud Storage: Cloud Storage Access Application Log: Application Log Content Microsoft 365 Unified Audit Logs Azure Storage Diagnostic Logs Azure Activity Logs

Required Tables

OfficeActivity StorageBlobLogs AzureActivity

False Positives

  • Backup and migration tools (ShareGate, AvePoint, Metalogix) performing scheduled bulk downloads of SharePoint or OneDrive content during off-hours maintenance windows
  • Microsoft Purview eDiscovery operations and DLP scanning agents accessing large volumes of OneDrive files for compliance indexing or legal hold processing
  • Azure Blob containers legitimately configured for anonymous public access as static website hosting origins or CDN source buckets — anonymous access is expected and intended
  • Infrastructure-as-code pipelines (Terraform, Bicep, ARM templates) performing storage account writes and key listing operations during normal cloud provisioning and rotation workflows
  • Developers and DevOps engineers performing bulk blob downloads from development or staging storage accounts using Azure CLI, Azure Storage Explorer, or SDK tooling

Sigma rule & cross-platform mapping

The detection logic for Data from Cloud Storage (T1530) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  product: azure

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1530 Sigma rules on detection.fyi

Platform-specific guides for T1530

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-21 Research depth: deep
References (11)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1AWS S3 Anonymous Bucket Enumeration and Download

    Expected signal: AWS CloudTrail will record ListObjects and GetObject events with userIdentity.type=Anonymous and userIdentity.principalId=anonymous. sourceIPAddress will be the tester's public IP. No ARN present in the identity block. S3 server access logs (if enabled) will show - as the requester.

  2. Test 2AWS S3 Bulk Object Download with Valid Credentials

    Expected signal: CloudTrail records: ListObjects (eventName=ListObjectsV2) and multiple GetObject events from the same source IP within a short window. userIdentity.type=IAMUser or AssumedRole with the test key ARN. requestParameters.bucketName contains the target bucket. High event volume triggers the 50+ GetObject threshold in the SPL detection.

  3. Test 3Rclone Cloud Storage Sync (Exfiltration Tool Pattern)

    Expected signal: CloudTrail GetObject and ListObjectsV2 events with userAgent containing 'rclone/' version string (e.g., 'rclone/v1.65.0'). High-volume sequential GetObject events for each file in the bucket. The rclone.conf file will contain plaintext cloud credentials at ~/.config/rclone/rclone.conf — a forensic artifact.

  4. Test 4AADInternals OneDrive File Collection

    Expected signal: Microsoft 365 OfficeActivity logs: FileDownloaded operations with UserId matching the authenticated account, OfficeWorkload=OneDrive. UserAgent will identify AADInternals. ClientIP will be the tester's IP. Events appear in the Unified Audit Log within minutes. EntraID SigninLogs will show the authentication used to obtain the access token.

Response Playbook

Triage

  1. Identify the actor identity: for cloud IAM principals, determine whether this is a human user account, service account, assumed role, or federated identity — check whether the ARN or UPN matches a known application or automation service
  2. Geolocate the source IP and compare against the actor's typical access pattern — access from a new country, TOR exit node, or datacenter IP range for a normally office-based user is a strong escalation indicator
  3. Examine the user agent string — presence of rclone, pacu, boto3 scripts, or aadInternals in the user agent alongside bulk access is high-confidence adversarial tooling
  4. Review recent authentication events for the actor: check Azure AD SigninLogs or AWS CloudTrail Console/API authentication for impossible travel, MFA push fatigue indicators, or token theft signals (unfamiliar device, new ASN)
  5. Enumerate what was accessed: identify the specific S3 bucket paths, OneDrive folders, or SharePoint libraries accessed — determine if the content is sensitive (PII, credentials, financial records, source code)
  6. Check for concurrent or preceding reconnaissance activity: ListBucket, GetBucketPolicy, GetBucketAcl, or OfficeActivity SearchQueryPerformed events immediately before bulk downloads indicate deliberate targeting rather than accidental access

Containment

  1. If active exfiltration confirmed: immediately revoke or rotate the compromised credential — for AWS, deactivate the access key via IAM; for Azure, revoke the OAuth token and reset the account password; for SAS tokens, regenerate the storage account key to invalidate all outstanding SAS tokens
  2. Enable S3 Block Public Access at the account and bucket level if anonymous access was the entry point — use aws s3api put-public-access-block to deny all public access immediately
  3. If the accessing principal is an IAM role or service account: detach all policies and disable the account until investigation is complete, then re-provision with least-privilege permissions
  4. Place the compromised Azure Storage account in a locked state or apply a deny-all network ACL to block further access while investigation proceeds — AzureActivity LISTKEYS should be revoked via RBAC role removal
  5. Enable Azure Storage soft delete and versioning to prevent adversary deletion of evidence if not already configured, and place a litigation hold on the Microsoft 365 account if OneDrive data was accessed
  6. Block known attacker IPs at the cloud network boundary — apply AWS WAF rules or Azure Network Security Group deny rules for the observed source IPs

Evidence Collection

  1. AWS CloudTrail S3 data event logs — enable S3 object-level logging if not already active (Management Events alone do not capture GetObject/PutObject); retrieve 90-day log archive from the CloudTrail S3 bucket for the affected account
  2. AWS CloudTrail Management Events — review the last 30 days for IAM key creation, AssumeRole calls, and console logins by the suspect principal
  3. Azure Storage diagnostic logs (StorageBlobLogs) — download transaction logs from the Log Analytics workspace for the affected storage account, noting AuthenticationType, CallerIpAddress, and ResponseBodySize
  4. Microsoft 365 Unified Audit Log — export all OfficeActivity records for the suspect UserId over the past 30 days, focusing on FileDownloaded, SearchQueryPerformed, and SharingSet operations
  5. Azure AD SigninLogs and AuditLogs — pull authentication records for the compromised identity to identify when credentials were first used from the attacker IP and whether MFA was satisfied
  6. Endpoint forensics — if the actor is a human employee, collect browser history, prefetch files, and recently accessed files (Shellbags) to determine if rclone.exe or aws.exe was executed; check %APPDATA%\.rclone\rclone.conf for cloud credential stores
  7. Network flow logs — AWS VPC Flow Logs or Azure NSG Flow Logs for egress traffic volume from the affected environment during the attack window, to estimate total data volume transferred

Escalation Criteria

  • ! Sensitive data confirmed accessed: any S3 bucket or OneDrive folder containing PII, PHI, credentials, financial records, or source code repositories — mandatory escalation to CISO and legal/privacy team
  • ! Anonymous (unauthenticated) public access to a bucket or container that should not be public — indicates misconfiguration potentially exposed to the internet for an unknown period
  • ! Known adversary tooling detected in user agent (Rclone, Pacu, AADInternals) — these are not legitimate enterprise tools and indicate deliberate adversarial intent
  • ! Impossible travel or risky sign-in detected for the accessing account — credential compromise is likely and the blast radius of the account's cloud permissions must be assessed
  • ! Azure Storage LISTKEYS or REGENERATEKEY operations by a non-service-account identity — indicates adversary may have obtained long-term storage keys for persistent access
  • ! Cross-account or cross-subscription access — if the actor accessed storage accounts outside their normal scope of permissions, it suggests lateral movement within the cloud environment

Investigation Guide

Forensic Artifacts

  • > AWS CloudTrail S3 data event logs — GetObject records include the requester ARN, source IP, bucket, object key, HTTP status, and bytes transferred; enable at account level via S3 console or CLI
  • > AWS CloudTrail Management Events — IAM key creation (CreateAccessKey), STS assume-role (AssumeRole, AssumeRoleWithWebIdentity), and console login events for the suspect principal
  • > Azure Storage Transaction Logs (StorageBlobLogs) — CallerIpAddress, AuthenticationType, ResponseBodySize, and Uri fields provide full access audit trail when diagnostic logging is enabled
  • > Microsoft 365 Unified Audit Log — available in Microsoft Purview Compliance portal; contains FileDownloaded, SharingSet, and SearchQueryPerformed events with ClientIP and UserAgent
  • > Azure AD SigninLogs — authentication records with IP, device, MFA result, and risk score for the compromised identity; available in Azure AD portal or Log Analytics
  • > Rclone configuration file — %APPDATA%\.config\rclone\rclone.conf (Windows) or ~/.config/rclone/rclone.conf (Linux/macOS); contains cloud provider endpoints and access credentials in plaintext
  • > AWS credentials file — ~/.aws/credentials and ~/.aws/config on attacker endpoint if recovered; EC2 instance metadata API logs if credentials were stolen via SSRF
  • > S3 access log files — stored in a designated logging bucket; contains requester IP, request time, HTTP method, key, response code, bytes sent, and referrer per request

Tuning Guidance

The primary challenge with T1530 detection is distinguishing legitimate bulk access (backups, ETL, compliance scanning) from adversarial bulk exfiltration. Start by building an allowlist of known backup service accounts, DevOps principals, and ETL pipeline identities — exclude them from volume-based thresholds using the known principal ARN or UPN, not just IP addresses (IPs change). For OneDrive detections, increase the MassDownloadThreshold from 50 to 200 for accounts that regularly perform sync operations (sync clients legitimately download large file sets). For AWS S3, ensure CloudTrail S3 data event logging is enabled at the account level — Management Events alone do not capture GetObject or ListObjects. Without data events, this detection has no visibility. For Azure Blob, Storage Diagnostic Logs must be explicitly enabled per storage account and the workspace must be in the same region or cross-workspace queries configured. For the anonymous access pattern, first audit all storage accounts to understand which are intentionally public — create a reference list of legitimately public buckets/containers and exclude them from the AnonRequests=1 branch. The tool user-agent hunt is high-fidelity: rclone and Pacu have no legitimate enterprise use case and should always be investigated regardless of volume. Consider integrating Microsoft Entra ID Protection risk signals (risky users, risky sign-ins) as an enrichment step to prioritize alerts — a bulk download from an account flagged as at-risk by EIDP is near-certain malicious activity.

Hunting Queries

Hunt for known cloud exfiltration and adversary tooling user agents (Rclone, Pacu, AADInternals, Python requests) making requests to OneDrive or SharePoint. These tools have no legitimate enterprise use case and their presence in Microsoft 365 audit logs indicates deliberate data theft tooling.

Hunting — KQL
kql 
// Hunt for known cloud exfiltration tool user agents in OneDrive activity
OfficeActivity
| where TimeGenerated > ago(7d)
| where OfficeWorkload in ("OneDrive", "SharePoint")
| where UserAgent has_any ("rclone", "pacu", "aadInternals", "python-requests", "go-http-client")
| summarize
    AccessCount = count(),
    Operations = make_set(Operation),
    Files = make_set(SourceFileName, 10),
    Sites = make_set(SiteUrl, 5)
    by UserId, ClientIP, UserAgent
| sort by AccessCount desc
Hunting — SPL
spl 
index=o365 sourcetype=o365:management:activity
  (Workload="OneDrive" OR Workload="SharePoint")
| where match(lower(UserAgent), "(rclone|pacu|aadinternals|python-requests|go-http-client|boto3)")
| stats
    count as AccessCount,
    values(Operation) as Operations,
    values(SourceFileName) as Files,
    values(SiteUrl) as Sites
    by UserId, ClientIP, UserAgent
| sort - AccessCount

Hunt for storage permission or configuration changes followed by bulk data access within the same resource. This two-stage pattern — modify permissions then download — is characteristic of adversaries who first unlock access (removing public access blocks, listing keys, modifying ACLs) before performing automated bulk extraction.

Hunting — KQL
kql 
// Hunt for S3-equivalent public access or cross-account role assumption before large downloads
AzureActivity
| where TimeGenerated > ago(14d)
| where ResourceProviderValue =~ "MICROSOFT.STORAGE"
| where OperationNameValue in (
    "MICROSOFT.STORAGE/STORAGEACCOUNTS/LISTKEYS/ACTION",
    "MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/WRITE",
    "MICROSOFT.STORAGE/STORAGEACCOUNTS/WRITE"
    )
| where ActivityStatusValue =~ "Success"
| join kind=inner (
    StorageBlobLogs
    | where TimeGenerated > ago(14d)
    | where OperationName in ("GetBlob", "ListBlobs")
    | where StatusCode == 200
    | summarize DownloadsAfterChange = count() by AccountName, CallerIpAddress, bin(TimeGenerated, 1h)
    | where DownloadsAfterChange > 20
) on $left.ResourceGroup == $right.AccountName
| project AzureActivity_Time=TimeGenerated, Caller, CallerIpAddress, OperationNameValue, ResourceId, DownloadsAfterChange
| sort by AzureActivity_Time desc
Hunting — SPL
spl 
index=aws sourcetype=aws:cloudtrail
  (eventName="PutBucketAcl" OR eventName="PutBucketPolicy"
   OR eventName="DeleteBucketPolicy" OR eventName="PutPublicAccessBlock")
| eval ConfigChangeTime=_time
| eval Bucket='requestParameters.bucketName'
| eval Actor='userIdentity.arn'
| join Bucket [
    search index=aws sourcetype=aws:cloudtrail eventName="GetObject"
    | bin _time span=1h
    | stats count as DownloadCount, dc('requestParameters.key') as UniqueKeys by 'requestParameters.bucketName', _time
    | rename 'requestParameters.bucketName' as Bucket
    | where DownloadCount > 20
]
| table ConfigChangeTime, Bucket, Actor, DownloadCount, UniqueKeys
| sort - ConfigChangeTime

Hunt for users or principals performing the majority of their cloud storage downloads outside business hours (before 7am or after 8pm). Legitimate users typically access files during work hours; adversaries using automated tools often operate at night or on weekends to reduce chance of detection. A 70%+ off-hours ratio with high volume is a strong behavioral indicator.

Hunting — KQL
kql 
// Hunt for off-hours or geographically anomalous cloud storage access
OfficeActivity
| where TimeGenerated > ago(7d)
| where OfficeWorkload in ("OneDrive", "SharePoint")
| where Operation in ("FileDownloaded", "FileSyncDownloadedFull", "FileCopied")
| extend HourOfDay = datetime_part("Hour", TimeGenerated)
| extend IsOffHours = iff(HourOfDay < 7 or HourOfDay > 20, 1, 0)
| summarize
    TotalFiles = count(),
    OffHoursFiles = sumif(1, IsOffHours == 1),
    OffHoursPct = round(100.0 * sumif(1, IsOffHours == 1) / count(), 1),
    SourceIPs = make_set(ClientIP, 5),
    UniqueCountries = dcount(ClientIP)
    by UserId
| where TotalFiles > 20 and OffHoursPct > 70
| sort by TotalFiles desc
Hunting — SPL
spl 
index=aws sourcetype=aws:cloudtrail eventSource="s3.amazonaws.com" eventName="GetObject"
| eval HourOfDay=strftime(_time, "%H")
| eval IsOffHours=if(HourOfDay < "07" OR HourOfDay > "20", 1, 0)
| stats
    count as TotalRequests,
    sum(IsOffHours) as OffHoursRequests,
    dc(sourceIPAddress) as UniqueIPs,
    values('requestParameters.bucketName') as Buckets
    by 'userIdentity.arn'
| eval OffHoursPct=round(100 * OffHoursRequests / TotalRequests, 1)
| where TotalRequests > 50 AND OffHoursPct > 70
| sort - TotalRequests

Atomic Red Team Tests

Test 1 AWS S3 Anonymous Bucket Enumeration and Download
linux

Simulates an adversary accessing a publicly misconfigured S3 bucket using anonymous (unsigned) requests. The --no-sign-request flag instructs the AWS CLI to omit authentication headers entirely, replicating anonymous public access. Run against a bucket you own and have configured with public read for testing purposes. This replicates Pacu's s3__download_bucket module behavior.

Command

bash 
aws s3 ls s3://YOUR-TEST-BUCKET-NAME/ --no-sign-request
aws s3 sync s3://YOUR-TEST-BUCKET-NAME/ /tmp/s3-anon-test/ --no-sign-request

Cleanup

bash 
rm -rf /tmp/s3-anon-test/

Expected Telemetry

AWS CloudTrail will record ListObjects and GetObject events with userIdentity.type=Anonymous and userIdentity.principalId=anonymous. sourceIPAddress will be the tester's public IP. No ARN present in the identity block. S3 server access logs (if enabled) will show - as the requester.

Expected Detection

SPL: HasAnonymousAccess=1, SuspicionScore >= 3, Severity=High. KQL (BlobAlert equivalent): AnonRequests > 0, AlertType=AzureBlob_AnonymousAccess for Azure equivalent tests.

Test 2 AWS S3 Bulk Object Download with Valid Credentials
linux

Simulates adversary using compromised AWS access keys to enumerate and bulk-download S3 bucket contents, replicating the Pacu s3__download_bucket module and Fox Kitten TTPs. The recursive listing followed by sync downloads all objects in the bucket. Run against a test bucket with non-sensitive content.

Command

bash 
export AWS_ACCESS_KEY_ID=YOUR_TEST_KEY_ID
export AWS_SECRET_ACCESS_KEY=YOUR_TEST_SECRET_KEY
aws s3 ls s3://YOUR-TEST-BUCKET-NAME/ --recursive
aws s3 sync s3://YOUR-TEST-BUCKET-NAME/ /tmp/s3-bulk-test/ --region us-east-1

Cleanup

bash 
rm -rf /tmp/s3-bulk-test/
unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY

Expected Telemetry

CloudTrail records: ListObjects (eventName=ListObjectsV2) and multiple GetObject events from the same source IP within a short window. userIdentity.type=IAMUser or AssumedRole with the test key ARN. requestParameters.bucketName contains the target bucket. High event volume triggers the 50+ GetObject threshold in the SPL detection.

Expected Detection

SPL: DownloadCount > 50, SuspicionScore >= 1. KQL: FileCount > MassDownloadThreshold. Both fire within the 30-minute aggregation window when downloading a bucket with 50+ objects.

Test 3 Rclone Cloud Storage Sync (Exfiltration Tool Pattern)
linux

Rclone is explicitly referenced in MITRE ATT&CK T1530 references and has been used in multiple ransomware extortion campaigns (Conti, LockBit, ALPHV) to bulk-exfiltrate data from cloud storage. This test configures Rclone with AWS S3 credentials and performs a sync to a local directory, generating the rclone user agent in CloudTrail logs which is a high-fidelity indicator. Install Rclone: curl https://rclone.org/install.sh | sudo bash

Command

bash 
rclone config create s3-test s3 provider=AWS access_key_id=YOUR_TEST_KEY_ID secret_access_key=YOUR_TEST_SECRET env_auth=false region=us-east-1
rclone ls s3-test:YOUR-TEST-BUCKET-NAME
rclone copy s3-test:YOUR-TEST-BUCKET-NAME /tmp/rclone-exfil-test/ --max-age 7d

Cleanup

bash 
rm -rf /tmp/rclone-exfil-test/
rclone config delete s3-test
rm -f ~/.config/rclone/rclone.conf

Expected Telemetry

CloudTrail GetObject and ListObjectsV2 events with userAgent containing 'rclone/' version string (e.g., 'rclone/v1.65.0'). High-volume sequential GetObject events for each file in the bucket. The rclone.conf file will contain plaintext cloud credentials at ~/.config/rclone/rclone.conf — a forensic artifact.

Expected Detection

SPL: KnownToolDetected=1, SuspicionScore += 2. The rclone user agent match alone raises suspicion score. Combined with DownloadCount > 50, overall SuspicionScore >= 3, Severity=High. Tool user agent hunting query fires regardless of volume.

Test 4 AADInternals OneDrive File Collection
windows

AADInternals is a PowerShell toolkit used by threat actors (HAFNIUM, APT42) to interact with Microsoft 365 APIs. This test simulates using AADInternals to list and download files from a target user's OneDrive, which generates OfficeActivity FileDownloaded events with the AADInternals user agent. Requires AADInternals module and valid Microsoft 365 credentials. Install with: Install-Module AADInternals

Command

powershell 
Import-Module AADInternals
$Credentials = Get-Credential
$AccessToken = Get-AADIntAccessTokenForOneDrive -Credentials $Credentials
$Files = Get-AADIntOneDriveFiles -AccessToken $AccessToken
$Files | Select-Object -First 10 | ForEach-Object { Get-AADIntOneDriveFile -AccessToken $AccessToken -FileId $_.Id -OutFile "$env:TEMP\$($_.Name)" }

Cleanup

powershell 
Remove-Item "$env:TEMP\*.docx","$env:TEMP\*.xlsx","$env:TEMP\*.pdf" -ErrorAction SilentlyContinue

Expected Telemetry

Microsoft 365 OfficeActivity logs: FileDownloaded operations with UserId matching the authenticated account, OfficeWorkload=OneDrive. UserAgent will identify AADInternals. ClientIP will be the tester's IP. Events appear in the Unified Audit Log within minutes. EntraID SigninLogs will show the authentication used to obtain the access token.

Expected Detection

KQL OneDriveAlert: FileCount incrementally increases per download — after 50 downloads fires at Medium severity. SPL: KnownToolDetected=1 from aadinternals user agent match, SuspicionScore >= 2. The tool user agent hunting query fires on any single file access.

Related Detections

Tactic Hub

TA0009Collection

Related Techniques

T1078.004Cloud AccountsT1552.001Credentials In FilesT1552.005Cloud Instance Metadata APIT1119Automated CollectionT1537Transfer Data to Cloud AccountT1213.002SharepointT1190Exploit Public-Facing ApplicationT1560.001Archive via UtilityT1567.002Exfiltration to Cloud Storage

Same Tactic: Collection

Popular Detections