Transfer Data to Cloud Account
Technique · ATTACK:enterprise:T1537
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1537",
"title": "Transfer Data to Cloud Account",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1537",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--d4bdbdea-eaec-4071-b4f9-5105e12ea4b6",
"external_id": "T1537",
"domain": "enterprise",
"created": "2019-08-30T13:03:04.038Z",
"modified": "2025-10-24T17:49:27.409Z",
"version": "1.5",
"aliases": [
],
"tactics": [
"exfiltration"
],
"source_references": [
{
"source_name": "AWS EBS Snapshot Sharing",
"url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-modifying-snapshot-permissions.html"
},
{
"source_name": "TLDRSec AWS Attacks",
"url": "https://tldrsec.com/p/blog-lesser-known-aws-attacks"
},
{
"source_name": "Azure Shared Access Signature",
"url": "https://docs.microsoft.com/en-us/rest/api/storageservices/delegate-access-with-shared-access-signature"
},
{
"source_name": "Azure Blob Snapshots",
"url": "https://docs.microsoft.com/en-us/azure/storage/blobs/snapshots-overview"
},
{
"source_name": "Microsoft Azure Storage Shared Access Signature",
"url": "https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview"
},
{
"source_name": "DOJ GRU Indictment Jul 2018",
"url": "https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"
}
]
}Explicit source assertions (7)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1537
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--16e7e622-1e34-48fe-954c-e1a4b103e204
Microsoft Storm-0501 Embargo Ransomware August 2025ATTACK:enterprise:M1057 → mitigates → ATTACK:enterprise:T1537
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1844caba-e446-4c82-aa0e-9f826c523a25
Google Workspace Data Loss Prevention · Microsoft Purview Data Loss PreventionATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1537
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--27fde8e9-ab78-43aa-9642-14ac0cd958ff
ATTACK:enterprise:G1032 → uses → ATTACK:enterprise:T1537
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--463d6149-8561-4e11-a5a7-c24faa34da62
Secureworks GOLD IONIC April 2024ATTACK:enterprise:M1054 → mitigates → ATTACK:enterprise:T1537
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8389c9f5-ace5-4240-a694-7008313fc168
Google Workspace External Sharing · Microsoft 365 External SharingATTACK:enterprise:M1037 → mitigates → ATTACK:enterprise:T1537
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a5b61b67-8d99-4bc5-86d0-00739f0be666
ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1537
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--abbf5417-5112-424d-85f4-e4622675b319
group-ib_redcurl1 · group-ib_redcurl2