Techniques › T1567 › T1567.002
T1567.002 Exfiltration to Cloud Storage
exfiltration — ESXi, Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
14
Sigma rules tagged attack.t1567.002
0
KEV CVEs mapped here
<p>Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet.</p><p>Examples of cloud storage services include Dropbox and Google Docs. Exfiltration to these cloud storage services can provide a significant amount of cover to the adversary if hosts within the network are already communicating with the service.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0570 Detection Strategy for Exfiltration to Cloud Storage v1.0
AN1571 WindowsUnusual processes (e.g., powershell.exe, excel.exe) accessing large local files and subsequently initiating HTTPS POST requests to domains associated with cloud storage services (e.g., dropbox.com, drive.google.com, box.com). Defender perspective: correlation between file reads in sensitive directories and high outbound traffic volume to known storage APIs.Tunable:
CloudStorageDomainsExfilVolumeThresholdUserContextAN1572 LinuxProcesses such as curl, wget, rclone, or custom scripts executing uploads to cloud storage endpoints. Defender perspective: detect chained events where tar/gzip is executed to compress files followed by HTTPS PUT/POST requests to known storage services.Tunable:AllowedToolsWorkHoursAN1573 macOSApplications or scripts invoking cloud storage APIs (Dropbox sync, iCloud, Google Drive client) in unexpected contexts. Defender perspective: detect sensitive file reads by non-standard applications followed by unusual encrypted uploads to external cloud storage domains.macos:unifiedlogexecution of curl, rclone, or Office apps invoking network sessions→ DC0032 Process CreationTunable:WatchedAppsEntropyThresholdAN1574 ESXiUnusual ESXi processes (vmx, hostd) reading datastore files and generating outbound HTTPS traffic toward external cloud storage endpoints. Defender perspective: anomalous datastore activity followed by network transfers to Dropbox, AWS S3, or other storage services.Tunable:DatastoreTransferThresholdApprovedStorageServices
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1567.002
Author: pH-T (Nextron Systems)
· 2022-07-15 (modified 2023-01-16) · logsource: product=windows category=dns_query · 065cceea-77ec-4030-9052-fc0affea7110
Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-16 (modified 2023-09-18) · logsource: product=windows service=dns-client · 090ffaad-c01a-4879-850c-6d57da98452d
Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration
Author: yatinwad, TheDFIRReport
· 2022-06-23 (modified 2023-09-18) · logsource: product=windows category=dns_query · 1cbbeaaf-3c8c-4e4c-9d72-49485b6a176b
Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration
Author: Florian Roth (Nextron Systems)
· 2022-04-20 · logsource: product=windows category=network_connection · 25eabf56-22f0-4915-a1ed-056b8dae0a68
Detects an executable that isn't dropbox but communicates with the Dropbox API
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-16 · logsource: product=windows service=dns-client · 29f171d7-aa47-42c7-9c7b-3c87938164d9
Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes
Author: Janantha Marasinghe
· 2022-10-18 · logsource: category=proxy · 2c03648b-e081-41a5-b9fb-7d854a915091
Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string
Author: Aaron Greetham (@beardofbinary) - NCC Group
· 2021-05-26 (modified 2023-05-09) · logsource: product=windows category=file_event · 34986307-b7f4-49be-92f3-e7a4d01ac5db
Detects Rclone config files being created
Author: Thomas Patzke
· 2019-11-12 (modified 2023-05-18) · logsource: category=proxy · 5ba715b6-71b7-44fd-8245-f66893e81b3d
Detects suspicious user agent string of APT40 Dropbox tool
Author: Aaron Greetham (@beardofbinary) - NCC Group
· 2021-05-26 (modified 2023-09-18) · logsource: product=windows category=dns_query · 613c03ba-0779-4a53-8a1f-47f914a4ded3
Detects DNS queries for subdomains related to MEGA sharing website
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-16 · logsource: product=windows service=dns-client · 66474410-b883-415f-9f8d-75345a0a66a6
Detects DNS queries for subdomains related to MEGA sharing website
Author: Nounou Mbeiri, Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-10-17 · logsource: product=windows category=process_creation · 6ddff2e8-ea1a-45d0-8938-93dfc1d67ae7
Detects the execution of the Restic backup tool, which can be used for data exfiltration.
Threat actors may leverage Restic to back up and exfiltrate sensitive data to remote storage locations, including cloud services.
If not legitimately used in the enterprise environment, its presence may indicate malicious activity.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-03-29 · logsource: product=windows category=process_creation · e328cc73-f92a-42fb-b3fa-7c2cffda981a
Detects usage of curl to upload files to known file sharing domains, which may indicate data exfiltration.
Author: Bhabesh Raj, Sittikorn S, Aaron Greetham (@beardofbinary) - NCC Group
· 2021-05-10 (modified 2023-03-05) · logsource: product=windows category=process_creation · e37db05d-d1f9-49c8-b464-cee1a4b11638
Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc
Author: Florian Roth (Nextron Systems)
· 2021-12-06 (modified 2024-05-31) · logsource: product=windows category=network_connection · fdeebdf0-9f3f-4d08-84a6-4c4d13e39fe4
Detects a network connection initiated by a binary to "api.mega.co.nz".
Attackers were seen abusing file sharing websites similar to "mega.nz" in order to upload/download additional payloads.
Rules tagged at the parent level (attack.t1567) 12
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update)
· 2022-09-15 (modified 2023-05-02) · logsource: product=linux category=process_creation · 00b90cc1-17ec-402c-96ad-3a8117d7a582
Detects a suspicious curl process start the adds a file to a web request
Author: Florian Roth (Nextron Systems), Cedric MAURUGEON (Update)
· 2020-07-03 (modified 2023-05-02) · logsource: product=windows category=process_creation · 00bca14a-df4e-4649-9054-3f2aa676bc04
Detects the execution of the "curl" process with "upload" flags. Which might indicate potential data exfiltration
Author: Florian Roth (Nextron Systems)
· 2022-07-16 (modified 2025-07-30) · logsource: product=windows category=network_connection · 18249279-932f-45e2-b37a-8925f2597670
Detects an executable initiating a network connection to "ngrok" domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Author: Florian Roth (Nextron Systems)
· 2022-11-03 · logsource: product=linux category=network_connection · 19bf6fdb-7721-4f3d-867f-53467f6a5db6
Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors
Author: Florian Roth (Nextron Systems)
· 2022-11-03 (modified 2024-02-02) · logsource: product=windows category=network_connection · 1d08ac94-400d-4469-a82f-daee9a908849
Detects an executable initiating a network connection to "ngrok" tunneling domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Author: frack113
· 2021-11-26 (modified 2022-05-16) · logsource: product=windows category=process_creation · 1f0f6176-6482-4027-b151-00071af39d7e
Detects the execution of "ConfigSecurityPolicy.EXE", a binary part of Windows Defender used to manage settings in Windows Defender.
Users can configure different pilot collections for each of the co-management workloads.
It can be abused by attackers in order to upload or download files.
Author: Kamran Saifullah
· 2023-11-20 · logsource: product=windows category=network_connection · 4b657234-038e-4ad5-997c-4be42340bce4
Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Author: Kamran Saifullah, Nasreddine Bencherchali (Nextron Systems)
· 2024-05-27 · logsource: product=windows category=network_connection · 7cd1dcdc-6edf-4896-86dc-d1f19ad64903
Detects network connections to Cloudflared tunnels domains initiated by a process on the system.
Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Author: Kamran Saifullah
· 2024-09-13 · logsource: product=windows category=network_connection · 9e02c8ec-02b9-43e8-81eb-34a475ba7965
Detects network connections to BTunnels domains initiated by a process on the system.
Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Author: Florian Roth (Nextron Systems)
· 2021-10-24 · logsource: category=dns · b593fd50-7335-4682-a36c-4edcb68e4641
Detects suspicious DNS queries to Monero mining pools
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-05-19 · logsource: product=windows category=network_connection · c3dbbc9f-ef1d-470a-a90a-d343448d5875
Detects an a non-browser process interacting with the Telegram API which could indicate use of a covert C2
Author: Ialle Teixeira @teixeira0xfffff, Austin Songer @austinsonger
· 2021-09-30 (modified 2022-05-16) · logsource: product=windows category=process_creation · e290b10b-1023-4452-a4a9-eb31a9013b3a
Detects when a user performs data exfiltration by using DataSvcUtil.exe