TA0010 · EXFILTRATION
Transfer Data to Cloud Account
Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service.
Detect it with
Monitor account activity for attempts to share data, snapshots, or backups with untrusted or unusual accounts on the same cloud service provider. Monitor for anomalous file transfer activity between accounts and to untrusted VPCs.
Why it matters on shift
Transfer Data to Cloud Account is one of the concrete ways adversaries achieve exfiltration. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After exfiltration, the next tactic is usually Impact. Search your telemetry for the transition before closing the ticket.
Kill-chain context