Data exfiltration from cloud database

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	1 Hour
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: Azure Audit Log OR Gcp Audit Log
Detection Modules	Cloud
Detector Tags	Cloud Data Asset Exfiltration, Data Detection & Response
ATT&CK Tactic	Exfiltration (TA0010), Collection (TA0009)
ATT&CK Technique	Data from Cloud Storage (T1530), Automated Exfiltration (T1020)
Severity	Low

Description

An identity tries to exfiltrate data from cloud database, as indicated by multiple signals.

Attacker's Goals

Exfiltrate data from the cloud environment.

Investigative actions

Check the identity which invoked the operation.

Variations

Data exfiltration from cloud database containing sensitive data from a production account toa foreign account

Synopsis

Field	Value
ATT&CK Tactic	Exfiltration (TA0010), Collection (TA0009)
ATT&CK Technique	Data from Cloud Storage (T1530), Automated Exfiltration (T1020)
Severity	High

Description

An identity tries to exfiltrate data from cloud database, as indicated by multiple signals.

Attacker's Goals

Exfiltrate data from the cloud environment.

Investigative actions

Check the identity which invoked the operation.

Suspicious data exfiltration from cloud database

Synopsis

Field	Value
ATT&CK Tactic	Exfiltration (TA0010), Collection (TA0009)
ATT&CK Technique	Data from Cloud Storage (T1530), Automated Exfiltration (T1020)
Severity	High

Description

An identity tries to exfiltrate data from cloud database, as indicated by multiple signals.

Attacker's Goals

Exfiltrate data from the cloud environment.

Investigative actions

Check the identity which invoked the operation.