Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-CloudControlPlane-CrossAccountExfil.
Upgrade to ProDetect Cloud-Native Data Exfiltration via Cross-Account Resource Sharing in Splunk
Adversaries with cloud administrative access can exfiltrate data without ever touching an endpoint agent or crossing a monitored network egress point, by using the cloud provider's own control plane to grant an attacker-controlled account read access to victim data. Common patterns include modifying an S3 bucket policy or ACL to grant access to an external AWS account (or to 'AllUsers'), sharing an EBS or RDS snapshot with an external account ID via ModifySnapshotAttribute/ModifyDBSnapshotAttribute, and granting AMI launch permissions to an external account via ModifyImageAttribute. Because the resulting data transfer happens entirely within the cloud provider's backbone between the victim account and the attacker's own account, it never appears in DeviceNetworkEvents, proxy logs, or DLP tooling — the only telemetry is the management-plane API call itself, recorded in AWS CloudTrail (or the equivalent Azure Activity Log / GCP Admin Activity log). Scattered Spider has been observed enumerating and exporting cloud snapshots and VM images during intrusions to stage data outside victim-controlled infrastructure; LAPSUS$ operators have similarly abused overly permissive cloud IAM access to copy source repositories and storage buckets to attacker-owned tenants. Detection must live in cloud audit-log telemetry rather than host or network telemetry, and hinges on distinguishing grants to known organizational account IDs (legitimate cross-account architectures, DR replication) from grants to unrecognized account IDs or public principals.
MITRE ATT&CK
- Tactic
- Exfiltration
SPL Detection Query
(index=aws sourcetype="aws:cloudtrail" eventSource=s3.amazonaws.com (eventName=PutBucketPolicy OR eventName=PutBucketAcl))
OR (index=aws sourcetype="aws:cloudtrail" eventSource IN ("ec2.amazonaws.com","rds.amazonaws.com") (eventName=ModifySnapshotAttribute OR eventName=ModifyDBSnapshotAttribute OR eventName=ModifyImageAttribute))
| eval RequestParams=requestParameters
| eval GrantsPublic=if(match(RequestParams, "(?i)(\"principal\":\"\*\"|allusers|\"group\":\"all\")"), 1, 0)
| eval HasExternalAccountRef=if(match(RequestParams, "arn:aws:iam::[0-9]{12}:") OR match(RequestParams, "[0-9]{12}"), 1, 0)
| eval IsKnownOrgAccount=if(match(RequestParams, "<YOUR_ORG_ACCOUNT_IDS_REGEX>"), 1, 0)
| where GrantsPublic=1 OR (HasExternalAccountRef=1 AND IsKnownOrgAccount=0)
| eval ThreatType=case(
eventName="PutBucketPolicy" OR eventName="PutBucketAcl", "S3_CrossAccount_PolicyExposure",
eventName="ModifyImageAttribute", "AMI_CrossAccount_Share",
eventName="ModifyDBSnapshotAttribute", "RDSSnapshot_CrossAccount_Share",
eventName="ModifySnapshotAttribute", "EBSSnapshot_CrossAccount_Share",
true(), "Unknown")
| eval RiskScore=if(GrantsPublic=1, 95, 80)
| table _time, eventName, eventSource, userIdentity.arn, sourceIPAddress, awsRegion, recipientAccountId, ThreatType, RiskScore
| sort - RiskScoreSPL detection over the Splunk AWS Add-on's aws:cloudtrail sourcetype. Flags PutBucketPolicy/PutBucketAcl calls that grant public or external-account S3 access, and ModifySnapshotAttribute/ModifyDBSnapshotAttribute/ModifyImageAttribute calls that share an EBS snapshot, RDS snapshot, or AMI with a public group or an account ID outside the organization's allowlist.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Cross-account replication to sibling AWS accounts inside the same AWS Organization that are not yet reflected in the org account allowlist
- AMI publishing pipelines that intentionally grant public launch permissions for Marketplace listings
Other platforms for THREAT-CloudControlPlane-CrossAccountExfil
Testing Methodology
Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate S3 Bucket Policy Exposure to External Account
Expected signal: AWS CloudTrail management event: eventName=PutBucketPolicy, eventSource=s3.amazonaws.com, requestParameters containing the external account ARN 999999999999 and Principal grant.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-CloudControlPlane-CrossAccountExfil — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month