Techniques › T1567.002 › AN1571
AN1571 Analytic 1571
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Unusual processes (e.g., powershell.exe, excel.exe) accessing large local files and subsequently initiating HTTPS POST requests to domains associated with cloud storage services (e.g., dropbox.com, drive.google.com, box.com). Defender perspective: correlation between file reads in sensitive directories and high outbound traffic volume to known storage APIs.</p>
- Detects
- T1567.002 Exfiltration to Cloud Storage
- Part of
- DET0570 Detection Strategy for Exfiltration to Cloud Storage
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=4663, 4670, 4656 | DC0055 File Access |
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
CloudStorageDomains | List of monitored domains for cloud services (dropbox.com, drive.google.com, onedrive.live.com). |
ExfilVolumeThreshold | Data volume threshold (e.g., >10MB in single session) used to flag abnormal transfers. |
UserContext | User accounts permitted to use sanctioned cloud services versus unexpected accounts. |