Analytics
Informational
✕
An identity initiated a download of multiple cloud objects
An identity initiated a download of multiple cloud objects. This might be an indication for an adversary trying to exfiltrate data from cloud storage.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- AWS Audit Log, Azure Audit Log, Gcp Audit Log
ATT&CK tactics: Collection (TA0009) Exfiltration (TA0010)
ATT&CK techniques: Data from Cloud Storage (T1530) Transfer Data to Cloud Account (T1537)
Detector tags: Cloud Data Asset Exfiltration
Attacker's goals:
Exfiltrate data from the cloud environment.
Investigative actions:
Check the identity which invoked the operations. Check the accessed resource and verify it doesn't contain sensitive data.
- Test period:
- 1 Hour
- Deduplication:
- 1 Day
2 variations:
- An identity initiated a download of multiple cloud objects in large volume compared to the project's usual volume Medium (parent: Informational)
- An identity initiated a download of multiple cloud objects in large volume compared to the bucket's usual volume Low (parent: Informational)