Detect Data from Cloud Storage in Google Chronicle

rule t1530_data_from_cloud_storage {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects bulk data exfiltration from cloud storage services including AWS S3, Azure Blob Storage, and Microsoft 365 OneDrive/SharePoint. Covers anonymous access, known exfiltration tools (rclone, pacu, aadInternals), mass downloads exceeding threshold, and Azure Storage key listing or config changes used by Storm-0501 for exfil staging."
    mitre_attack_technique = "T1530"
    mitre_attack_tactic = "Collection"
    severity = "HIGH"
    confidence = "HIGH"
    platforms = "AWS, Azure, GCP, Microsoft365"
    reference = "https://attack.mitre.org/techniques/T1530/"

  events:
    (
      (
        $e.metadata.log_type = "AWS_CLOUDTRAIL"
        and $e.target.resource.resource_type = "STORAGE_OBJECT"
        and $e.metadata.product_event_type in (
          "GetObject", "ListBucket", "ListObjects", "ListObjectsV2",
          "GetBucketAcl", "GetBucketPolicy", "GetBucketPublicAccessBlock"
        )
        and not $e.security_result.action = "BLOCK"
      )
      or
      (
        $e.metadata.log_type = "OFFICE_365"
        and $e.target.resource.attribute.cloud.availability_zone in (
          "OneDrive", "SharePoint"
        )
        and $e.metadata.product_event_type in (
          "FileDownloaded", "FileSyncDownloadedFull",
          "FileAccessed", "FileCopied"
        )
      )
      or
      (
        $e.metadata.log_type = "AZURE_ACTIVITY"
        and $e.metadata.product_event_type in (
          "MICROSOFT.STORAGE/STORAGEACCOUNTS/WRITE",
          "MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/WRITE",
          "MICROSOFT.STORAGE/STORAGEACCOUNTS/LISTKEYS/ACTION",
          "MICROSOFT.STORAGE/STORAGEACCOUNTS/REGENERATEKEY/ACTION"
        )
        and $e.security_result.action = "ALLOW"
      )
    )
    $e.principal.ip != ""
    $e.principal.ip = $src_ip
    $e.principal.user.userid = $user

  match:
    $src_ip, $user over 30m

  outcome:
    $event_count = count($e.metadata.id)
    $unique_objects = count_distinct($e.target.resource.product_object_id)
    $anon_count = sum(
      if($e.principal.user.userid = "Anonymous"
        or $e.principal.user.userid = "AnonUser"
        or re.regex($e.principal.user.userid, `(?i)^anon`),
        1, 0)
    )
    $tool_detected = max(
      if(re.regex($e.network.http.user_agent,
        `(?i)(rclone\/|pacu|aadInternals|aws-cli\/|boto3\/|python-requests\/|s3browser|CloudBerry)`),
        1, 0)
    )
    $storage_config_change = max(
      if($e.metadata.product_event_type in (
        "MICROSOFT.STORAGE/STORAGEACCOUNTS/LISTKEYS/ACTION",
        "MICROSOFT.STORAGE/STORAGEACCOUNTS/REGENERATEKEY/ACTION"
      ), 1, 0)
    )
    $suspicion_score =
      if($anon_count > 0, 3, 0)
      + if($event_count > 500, 3, if($event_count > 100, 2, if($event_count > 50, 1, 0)))
      + if($unique_objects > 20, 1, 0)
      + if($tool_detected > 0, 2, 0)
      + if($storage_config_change > 0, 2, 0)

  condition:
    $event_count > 50
    or $anon_count > 0
    or $tool_detected > 0
    or $storage_config_change > 0
}