Detect Transfer Data to Cloud Account in Google Chronicle

rule T1537_Transfer_Data_To_Cloud_Account {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1537: data exfiltration via cross-account cloud transfer using AzCopy, SAS token generation, snapshot sharing, or MEGA upload tools."
    severity = "HIGH"
    mitre_attack_technique = "T1537"
    mitre_attack_tactic = "Exfiltration"
    reference = "https://attack.mitre.org/techniques/T1537/"
    created = "2026-04-20"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.metadata.product_event_type != ""
    (
      (
        re.regex($e.target.process.file.full_path, `(?i)(^|[/\\])azcopy(\.exe)?$`) and
        (
          re.regex($e.target.process.command_line, `(?i)blob\.core\.windows\.net`) or
          re.regex($e.target.process.command_line, `(?i)mega\.nz`) or
          re.regex($e.target.process.command_line, `(?i)(megatools|megacopy|megaput)`) or
          re.regex($e.target.process.command_line, `(?i)s3\.amazonaws\.com`)
        )
      ) or
      (
        re.regex($e.target.process.file.full_path, `(?i)(powershell|pwsh|az\.cmd|python)(\.exe)?$`) and
        (
          re.regex($e.target.process.command_line, `(?i)New-AzStorage(Blob|Container|Account)SASToken`) or
          re.regex($e.target.process.command_line, `(?i)az storage (blob|container|account) generate-sas`) or
          re.regex($e.target.process.command_line, `(?i)GenerateSasUri`) or
          re.regex($e.target.process.command_line, `(?i)generate-sas`)
        ) and
        (
          re.regex($e.target.process.command_line, `(?i)(--expiry|-ExpiryTime|--permissions|rwdl|racwdl)`)
        )
      ) or
      (
        re.regex($e.target.process.file.full_path, `(?i)(powershell|pwsh|az\.cmd|aws|python)(\.exe)?$`) and
        re.regex($e.target.process.command_line, `(?i)(az snapshot (create|grant-access)|az disk create|New-AzSnapshot|Grant-AzSnapshotAccess|ec2 (copy-snapshot|modify-snapshot-attribute|create-image|modify-image-attribute)|CreateSnapshot|CopySnapshot)`)
      ) or
      (
        re.regex($e.target.process.file.full_path, `(?i)(megacopy|megaput|megals|MegaSync|megatools|megacmd|mega-put|mega-copy)(\.exe)?$`) or
        re.regex($e.target.process.command_line, `(?i)(mega\.nz|megatools|megacopy|megaput|MegaSync)`)
      )
    )

  condition:
    $e
}