T1567.002 Exfiltration to Cloud Storage

Technique

T1567.002

Tactics

Exfiltration

Research, 90 days

4

KEV CVEs mapped

0

SigmaHQ rules

14

Elastic, Splunk

21

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1567/002

MITRE description

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet. Examples of cloud storage services include Dropbox and Google Docs. Exfiltration to these cloud storage services can provide a significant amount of cover to the adversary if hosts within the network are already communicating with the service.

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-10-29 Cisco Talos: IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
• 2026-10-21 Group-IB: Stray Cat, Open Doors: How k0t Wanders Through the Network Edge
• 2026-10-15 GuidePoint GRIT: Behind the Help Desk Call: Insights from the Leaked Chats of an IT-Impersonation Extortion Crew
• 2026-08-12 Huntress: Akira Hits Safe Mode: Ransomware Rebooting Around EDR

Detection coverage

SigmaHQ community rules

• APT40 Dropbox Tool User Agent (emerging-threats)
• Rclone Activity via Proxy (core)
• DNS Query for Anonfiles.com Domain - DNS Client (core)
• DNS Query To MEGA Hosting Website - DNS Client (core)
• DNS Query To Ufile.io - DNS Client (core)
• DNS Query for Anonfiles.com Domain - Sysmon (core)
• DNS Query To MEGA Hosting Website (core)
• DNS Query To Ufile.io (core)
• Rclone Config File Creation (core)
• Suspicious Dropbox API Usage (core)
• Network Connection Initiated To Mega.nz (core)
• Curl File Upload To File Sharing Websites (core)
• PUA - Rclone Execution (core)
• PUA - Restic Backup Tool Execution (core)

Elastic and Splunk rules

• Potential Third-Party Cloud Storage Client Execution (elastic)
• AWS DynamoDB Table Exported to S3 (elastic)
• AWS EC2 Export Task (elastic)
• AWS RDS Snapshot Export (elastic)
• AWS S3 Bucket Replicated to Another Account (elastic)
• AWS API Activity from Uncommon S3 Client by Rare User (elastic)
• Azure Storage Blob Retrieval via AzCopy (elastic)
• Unusual DNS Request to Suspicious Top Level Domain (elastic)
• Suspicious AWS S3 Connection via Script Interpreter (elastic)
• Unusual Network Connection to Suspicious Web Service (elastic)
• Connection to Commonly Abused Web Services (elastic)
• Potential PowerShell HackTool Script by Function Names (elastic)
• AzCopy or Azure Storage Explorer Usage on Unusual Host (elastic)
• Potential Data Exfiltration via Rclone (elastic)
• M365 Purview DLP Signal (elastic)
• DNS to Commonly Abused Web Services (elastic)
• Cisco NVM - Rclone Execution With Network Activity (splunk)
• Windows Azure Storage Utility Execution Via CLI (splunk)
• Windows OneDrive Share Mounted via Net (splunk)
• Cisco Secure Firewall - Connection to File Sharing Domain (splunk)
• Cisco Secure Firewall - Potential Data Exfiltration (splunk)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.