Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-CloudControlPlane-CrossAccountExfil.
Upgrade to ProDetect Cloud-Native Data Exfiltration via Cross-Account Resource Sharing in CrowdStrike LogScale
Adversaries with cloud administrative access can exfiltrate data without ever touching an endpoint agent or crossing a monitored network egress point, by using the cloud provider's own control plane to grant an attacker-controlled account read access to victim data. Common patterns include modifying an S3 bucket policy or ACL to grant access to an external AWS account (or to 'AllUsers'), sharing an EBS or RDS snapshot with an external account ID via ModifySnapshotAttribute/ModifyDBSnapshotAttribute, and granting AMI launch permissions to an external account via ModifyImageAttribute. Because the resulting data transfer happens entirely within the cloud provider's backbone between the victim account and the attacker's own account, it never appears in DeviceNetworkEvents, proxy logs, or DLP tooling — the only telemetry is the management-plane API call itself, recorded in AWS CloudTrail (or the equivalent Azure Activity Log / GCP Admin Activity log). Scattered Spider has been observed enumerating and exporting cloud snapshots and VM images during intrusions to stage data outside victim-controlled infrastructure; LAPSUS$ operators have similarly abused overly permissive cloud IAM access to copy source repositories and storage buckets to attacker-owned tenants. Detection must live in cloud audit-log telemetry rather than host or network telemetry, and hinges on distinguishing grants to known organizational account IDs (legitimate cross-account architectures, DR replication) from grants to unrecognized account IDs or public principals.
MITRE ATT&CK
- Tactic
- Exfiltration
LogScale Detection Query
eventSource=/s3\.amazonaws\.com|ec2\.amazonaws\.com|rds\.amazonaws\.com/
eventName=/^(PutBucketPolicy|PutBucketAcl|ModifySnapshotAttribute|ModifyDBSnapshotAttribute|ModifyImageAttribute)$/
requestParameters=/(?i)(AllUsers|"Principal":"\*"|"group":"all"|arn:aws:iam::[0-9]{12}:)/
| ThreatType := case {
eventName="PutBucketPolicy" OR eventName="PutBucketAcl" => "S3_CrossAccount_PolicyExposure";
eventName="ModifyImageAttribute" => "AMI_CrossAccount_Share";
eventName="ModifyDBSnapshotAttribute" => "RDSSnapshot_CrossAccount_Share";
eventName="ModifySnapshotAttribute" => "EBSSnapshot_CrossAccount_Share";
* => "Unknown"
}
| RiskScore := case {
requestParameters=/(?i)AllUsers/ => 95;
* => 80
}
| groupBy([eventName, userIdentity.arn, sourceIPAddress, recipientAccountId, ThreatType], function=[count(as=EventCount), max(field=RiskScore, as=MaxRisk)])
| sort(field=MaxRisk, order=desc)CrowdStrike LogScale (Falcon) query over an ingested AWS CloudTrail repo. Flags PutBucketPolicy/PutBucketAcl and ModifySnapshotAttribute/ModifyDBSnapshotAttribute/ModifyImageAttribute events whose request parameters reference a public grant or an external AWS account ARN, grouped by calling identity, source IP, and recipient account for triage.
Data Sources
Required Tables
False Positives & Tuning
- Cross-account replication to a sibling AWS account not yet reflected in an org account allowlist — supplement with a LogScale lookup file of known organization account IDs and exclude matches
- IaC automation (Terraform/CloudFormation) service roles performing scheduled, approved resource-sharing changes — exclude by userIdentity.arn matching known automation role ARNs
Other platforms for THREAT-CloudControlPlane-CrossAccountExfil
Testing Methodology
Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate S3 Bucket Policy Exposure to External Account
Expected signal: AWS CloudTrail management event: eventName=PutBucketPolicy, eventSource=s3.amazonaws.com, requestParameters containing the external account ARN 999999999999 and Principal grant.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-CloudControlPlane-CrossAccountExfil — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month