auren-research/cyber-sec huggingface dataset:
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--39b9db72-8b48-4595-a18d-db5bbba3091b
created: 2021-10-20T15:05:19.274Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0088
external_id: DC0088
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Logon Session Metadata
description: Contextual data about a logon session, such as username, logon type, access tokens (security context, user SIDs, logon identifiers, and logon SID), and any activity associated within it
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: Logon Session
channel: None
name: WinEventLog:Security
channel: EventCode=4672
name: macos:unifiedlog
channel: LoginWindow context with associated PID linked to reopened plist paths
name: WinEventLog:Security
channel: EventCode=4672, 4634
name: azure:signinlogs
channel: SAML-based login with anomalous issuer or NotOnOrAfter lifetime
name: m365:unified
channel: Abnormal user claims or unexpected elevated role assignment in SAML assertion
name: macos:unifiedlog
channel: authd generating multiple MFA token requests
name: linux:syslog
channel: None
name: WinEventLog:Security
channel: EventCode=4624, 4625, 4768, 4769
name: linux:syslog
channel: sssd / sudo logs
name: esxi:hostd
channel: /var/log/hostd.log
name: WinEventLog:Security
channel: EventCode=4778, EventCode=4779
name: auditd:SYSCALL
channel: ssh logins or execve of remote commands
name: macos:unifiedlog
channel: Remote login (ssh) or screen sharing authentication attempts
name: kubernetes:audit
channel: Unauthorized container creation or kubelet exec logs
name: auditd:USER_LOGIN
channel: USER_LOGIN
name: macos:unifiedlog
channel: loginwindow or sshd
name: WinEventLog:Security
channel: EventCode=4800, 4801
name: WinEventLog:Security
channel: EventCode=4776, 4771, 4770
name: auditd:SYSCALL
channel: execve,socket,connect,openat
name: macos:unifiedlog
channel: Group membership change for admin or wheel
name: azure:audit
channel: Add delegated admin / Assign admin roles / Update application consent
name: saas:okta
channel: user.session.start, app.oauth2.as.authorize, policy.mfa.bypass
name: gcp:audit
channel: google.iam.credentials.generateAccessToken / serviceAccountTokenCreator
name: saas:salesforce
channel: ConnectedApp OAuth policy change / Login as user
name: macos:unifiedlog
channel: Unusual Kerberos TGS-REQ without TGT or anomalous ticket lifetime
name: saas:okta
channel: user.authentication.sso
name: m365:unified
channel: FileAccessed, SharingSet
name: m365:signinlogs
channel: UserLogin
name: macos:unifiedlog
channel: loginwindow, sshd
name: NSM:Connections
channel: Successful sudo or ssh from unknown IPs
name: macos:unifiedlog
channel: loginwindow or sshd events with external IP
name: macos:unifiedlog
channel: process = 'sshd'
name: esxi:auth
channel: None
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--3acecdde-c327-4498-9bb8-33a2e63c6c57
created: 2021-10-20T15:05:19.275Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0098
external_id: DC0098
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Volume Deletion
description: The removal of a cloud-based or on-premise block storage volume. This action permanently deletes the allocated storage and may result in data loss if not backed up.

*Data Collection Measures:*

- Cloud Logging & APIs
 - AWS CloudTrail Logs
 - `eventName: DeleteVolume` (tracks volume deletions)
 - Azure Monitor Logs
 - `operationName: Microsoft.Compute/disks/delete`
 - `status: Success | Failure` (flag unauthorized delete attempts)
 - Google Cloud Audit Logs
 - `protoPayload.methodName: "v1.compute.disks.delete"`
 - `authenticationInfo.principalEmail` (identifies the user deleting the volume)
- System & Host-Based Logging
 - Linux & macOS Logs:
 - `/var/log/syslog` or `/var/log/messages` for volume detach/deletion actions
 - Windows Event Logs:
 - Event ID 98 (Storage Class Memory)
 - Event ID 225 (Volume Removal Detected)
 - Event ID 12 (Disk Removal Notification)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: esxi:vmkernel
channel: file delete|datastore purge
name: AWS:CloudTrail
channel: DeleteVolume
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--3d6e6b3b-4aa8-40e1-8c47-91db0f313d9f
created: 2021-10-20T15:05:19.273Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0042
external_id: DC0042
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Drive Creation
description: The activity of assigning a new drive letter or creating a mount point for a data storage device, such as a USB, network share, or external hard drive, enabling access to its content on a host system. Examples: 

- USB Drive Insertion: A USB drive is plugged in and automatically assigned the letter `E:\` on a Windows machine.
- Network Drive Mapping: A network share `\\server\share` is mapped to the drive `Z:\`.
- Virtual Drive Creation: A virtual disk is mounted on `/mnt/virtualdrive` using an ISO image or a virtual hard disk (VHD).
- Cloud Storage Mounting: Google Drive is mounted as `G:\` on a Windows machine using a cloud sync tool.
- External Storage Integration: An external HDD or SSD is connected and assigned `/mnt/external` on a Linux system..
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: Drive
channel: None
name: WinEventLog:System
channel: Kernel-PnP 410/400 device install, disk added
name: auditd:SYSCALL
channel: mknod,open,openat
name: macos:unifiedlog
channel: mounted|appeared|DA: disk* attached
name: WinEventLog:System
channel: EventCode=1006
name: auditd:SYSCALL
channel: Removable media mount notification
name: macos:unifiedlog
channel: com.apple.diskarbitration
name: WinEventLog:System
channel: EventCode=1006, 10001
name: auditd:SYSCALL
channel: device event logs
name: linux:osquery
channel: mount_events
name: macos:unifiedlog
channel: Volume Mount + File Read
name: WinEventLog:System
channel: EventCode=2003
name: auditd:SYSCALL
channel: udev events or drive enumeration involving TinyPilot paths or device classes
name: linux:syslog
channel: Device attach logs containing TinyPilot/PiKVM identifiers
name: macos:unifiedlog
channel: Hardware enumeration events via IOKit or USBMuxd showing TinyPilot or unknown keyboard/mouse
name: auditd:SYSCALL
channel: Kernel Device Events - USB Block Devices
name: maos:osquery
channel: mount_events
name: macos:unifiedlog
channel: Volume Mount + Process Trace + File Read
name: journald:systemd
channel: udisks2 or udevd logs
name: macos:unifiedlog
channel: log stream --predicate 'eventMessage contains "USBMSC"'
name: linux:syslog
channel: New HID device enumeration with type 'keyboard' followed by immediate input injection
name: macos:unifiedlog
channel: New IOUSB keyboard/HID device enumerated with suspicious attributes
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--3da222e6-53f3-451c-a239-0b405c009432
created: 2021-10-20T15:05:19.273Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0057
external_id: DC0057
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Snapshot Creation
description: The process of taking a point-in-time copy of a cloud storage volume (files, settings, configurations, etc.), virtual machine (VM), or database that can be created and deployed in cloud environments.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: esxi:vmkernel
channel: snapshot create/write events
name: AWS:CloudTrail
channel: CreateSnapshot
name: azure:activity
channel: MICROSOFT.COMPUTE/SNAPSHOTS/WRITE
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--45977f14-1bcc-4ec4-ac14-a30fd3a11f44
created: 2021-10-20T15:05:19.272Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0023
external_id: DC0023
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Cloud Storage Modification
description: Cloud Storage Modification involves tracking changes made to cloud storage infrastructure, including updates to settings, permissions, or stored data. Examples include modifying object access control lists (ACLs), uploading new objects, or updating bucket policies. Examples: 

AWS S3: An object is uploaded or its ACL is modified.
- Azure Blob Storage: A blob's metadata or permissions are updated.
- Google Cloud Storage: An object's lifecycle policy is updated, or a bucket policy is changed.
- OpenStack Swift: Modifications to container settings or uploading of new objects.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: AWS:CloudTrail
channel: PutBucketLifecycle, PutLifecycleConfiguration, SetBucketLifecycle, storage.buckets.update
name: AWS:CloudTrail
channel: PutObject (with SSE-C), UploadPart (SSE-C)
name: AWS:CloudTrail
channel: PutBucketPolicy
name: m365:unified
channel: SharingSet
name: saas:googledrive
channel: drive.permission.add
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--45d0ff14-b9c4-41f5-8603-156657c20b75
created: 2021-10-20T15:05:19.274Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0073
external_id: DC0073
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:14:40.223Z
name: Instance Modification
description: Changes made to a virtual machine (VM) or compute instance, including alterations to its configuration, metadata, attached policies, or operational state. Such modifications can include updating metadata, attaching or detaching resource policies, resizing instances, or modifying network configurations. Examples:

- AWS: instance modifications include API actions like `ModifyInstanceAttribute`, `ModifyInstanceMetadataOptions`, or `RebootInstances`.
- Azure: modifications can be tracked through operations like `Microsoft.Compute/virtualMachines/write`.
- GCP: instance modification events include operations like `instances.setMetadata`, `instances.addResourcePolicies`, or `instances.resize`.

*Data Collection Measures:*

- AWS CloudTrail: Log Location: Stored in S3 or forwarded to CloudWatch.
- Azure Activity Logs: Log Location: Accessible via Azure Monitor or exported to a storage account.
- GCP Audit Logs: Log Location: Logs Explorer or BigQuery.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: AWS:CloudTrail
channel: RevertSnapshot
name: azure:activity
channel: MICROSOFT.COMPUTE/VIRTUALMACHINES/RESTORE
name: gcp:audit
channel: compute.instances.restore
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--45fd904d-6eb0-4b50-8478-a961f09f898b
created: 2021-10-20T15:05:19.274Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0086
external_id: DC0086
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Instance Metadata
description: Contextual data about an instance and activity around it such as name, type, or status
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: AWS:CloudTrail
channel: DescribeInstances
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--4c41e296-b8d2-4a37-b789-eb565c87c00c
created: 2021-10-20T15:05:19.272Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0022
external_id: DC0022
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Cloud Storage Deletion
description: Cloud Storage Deletion refers to the removal or destruction of cloud storage infrastructure, such as buckets, containers, or directories, within a cloud environment. Monitoring this activity is critical to detecting potential unauthorized or malicious actions, such as data destruction by adversaries or accidental deletions that may lead to data loss. Examples: 

- AWS S3 Bucket Deletion: An AWS user deletes an S3 bucket using the `DeleteBucket` API call.
- Azure Blob Storage Container Deletion: A user deletes a container in Azure Blob Storage using the `Delete Container` operation.
- Google Cloud Storage Bucket Deletion: A Google Cloud user deletes a bucket using the `storage.buckets.delete` API.
- OpenStack Swift Container Deletion: A user deletes a container in OpenStack Swift using the `DELETE` method.

This data component can be collected through the following measures:

Enable Logging for Cloud Storage Services

- AWS S3: Enable AWS CloudTrail to log DeleteBucket API actions.
- Azure Blob Storage: Enable Azure Monitor and Diagnostic Logs to capture Delete Container operations. Use Azure Event Grid to capture and trigger alerts for container deletion.
- Google Cloud Storage: Enable Data Access logs in Cloud Audit Logs to monitor storage.buckets.delete API calls.
- OpenStack Swift: Configure Swift logging to capture DELETE requests for containers.

Centralized Logging and Analysis

- Use platforms like Splunk or native SIEMs to forward and analyze logs for anomalies in cloud storage deletions.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: AWS:CloudTrail
channel: DeleteBucket, DeleteDBCluster, DeleteSnapshot, TerminateInstances
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--5263cb33-08cc-4a68-820f-004e1e400d76
created: 2021-10-20T15:05:19.272Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0019
external_id: DC0019
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:14:37.749Z
name: Pod Creation
description: The initial deployment or instantiation of a new pod in a containerized environment. This includes creating a pod manually, through orchestration tools (Kubernetes), or via Infrastructure-as-Code (IaC) configurations. A Pod is the smallest deployable unit in Kubernetes, typically containing one or more containers. Creation methods include:
- Direct pod deployment (`kubectl run`, `kubectl apply`)
- Automated deployment via CI/CD pipelines (e.g., ArgoCD, Jenkins, GitOps)
- Infrastructure-as-Code (IaC) templates (e.g., Terraform, Helm Charts)
- API-based deployments via Kubernetes control plane (create_pod API calls)
- Pods can be ephemeral (short-lived) or persistent (part of a StatefulSet or Deployment).

*Data Collection Measures:*

- Kubernetes Audit Logs
 - Captures all API requests, including pod `create` events.
- Kube-api server Logs	
 - Monitors API calls related to pod deployments and modifications. Related Events: `PodSandboxChanged`, `SyncLoop`, `Created pod`
- Container Runtime Logs	
 - Logs from CRI-O, containerd, or Docker capture pod creation events. Related Events: `container start`, `container create`
- Cloud Provider Logs	
 - GKE, EKS, AKS logs provide insights into Kubernetes API interactions.
- SIEM & Log Aggregation	
 - Integrates Kubernetes logs into SIEM solutions.
- EDR/XDR Solutions	
 - Monitors container-based activity for anomalous pod creations.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: AWS:CloudTrail
channel: CreatePod: Programmatic creation of new pod resources using container images not seen before in the environment
name: kubernetes:audit
channel: create
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--5297a638-1382-4f0c-8472-0d21830bf705
created: 2021-10-20T15:05:19.273Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0060
external_id: DC0060
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Service Creation
description: The registration of a new service or daemon on an operating system.

*Data Collection Measures:*

- Windows Event Logs
 - Event ID 4697 - Captures the creation of a new Windows service.
 - Event ID 7045 - Captures services installed by administrators or adversaries.
 - Event ID 7034 - Could indicate malicious service modification or exploitation.
- Sysmon Logs
 - Sysmon Event ID 1 - Process Creation (captures service executables).
 - Sysmon Event ID 4 - Service state changes (detects service installation).
 - Sysmon Event ID 13 - Registry modifications (captures service persistence changes).
- PowerShell Logging
 - Monitor `New-Service` and `Set-Service` PowerShell cmdlets in Event ID 4104 (Script Block Logging).
- Linux/macOS Collection Methods
 - AuditD & Syslog Daemon Logs (`/var/log/syslog`, `/var/log/messages`, `/var/log/daemon.log`)
 - AuditD Rules:
 - `auditctl -w /etc/systemd/system -p wa -k service_creation`
 - Detects changes to `systemd` service configurations.
- Systemd Journals (`journalctl -u `)
 - Captures newly created systemd services.
- LaunchDaemons & LaunchAgents (macOS)
 - Monitor `/Library/LaunchDaemons/` and `/Library/LaunchAgents/` for new plist files.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: Service
channel: None
name: WinEventLog:System
channel: EventCode=7036
name: auditd:CONFIG_CHANGE
channel: creation or modification of systemd services
name: macos:osquery
channel: Process Events and Launch Daemons
name: WinEventLog:System
channel: EventCode=7045
name: linux:osquery
channel: newly registered unit file with ExecStart pointing to unknown binary
name: macos:unifiedlog
channel: creation or loading of new launchd services
name: WinEventLog:Security
channel: EventCode=4697
name: linux:syslog
channel: systemctl start/enable with uncommon binary paths
name: WinEventLog:System
channel: EventCode=7031, 7034
name: macos:osquery
channel: launch_daemons
name: macos:unifiedlog
channel: launchd loading new LaunchDaemon or changes to existing daemon configuration
name: macos:osquery
channel: detection of new launch agents with suspicious paths or unsigned binaries
name: kubernetes:audit
channel: create
name: containerLogs:systemd_unit_files
channel: unit file referencing container binary with persistent flags
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--58ef998c-f3bf-4985-b487-b1005f5c05d1
created: 2021-10-20T15:05:19.272Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0025
external_id: DC0025
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Cloud Storage Access
description: Cloud storage access refers to the retrieval or interaction with data stored in cloud infrastructure. This data component includes activities such as reading, downloading, or accessing files and objects within cloud storage systems. Common examples include API calls like GetObject in AWS S3, which retrieves objects from cloud buckets. Examples: 

- AWS S3 Access: An adversary uses the `GetObject` API to retrieve sensitive data from an AWS S3 bucket.
- Azure Blob Storage Access: A user accesses a blob in Azure Storage using `Get Blob` or `Get Blob Properties`.
- Google Cloud Storage Access: An adversary uses `storage.objects.get` to download objects from - OpenStack Swift Storage Access: A user retrieves an object from OpenStack Swift using the `GET` method.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: AWS:CloudTrail
channel: GetObject, CopyObject
name: AWS:CloudTrail
channel: PutObject: S3 writes with .sql/.csv extension by same identity or within 5 min of DB access
name: m365:unified
channel: Accessed SharePoint files or pages
name: m365:unified
channel: FileAccessed, FileDownloaded, ConsentGranted
name: gcp:workspaceaudit
channel: download, authorization_grant
name: m365:sharepoint
channel: AnonymousLinkCreated, FileDownloaded
name: m365:unified
channel: App-only or delegated access patterns where client_id != known enterprise apps
name: saas:github
channel: Artifact generated includes base64/encoded exfil payload or URL
type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--59ec10d9-546b-4b8e-bccb-fa85f71e5055
created: 2021-10-20T15:05:19.272Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0024
external_id: DC0024
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Cloud Storage Creation
description: Cloud Storage Creation refers to the initial creation of a new cloud storage resource, such as buckets, containers, or directories, within a cloud environment. This action is critical to track as it might indicate the legitimate provisioning of resources or unauthorized actions taken by adversaries to stage, store, or exfiltrate data. Examples: 

- AWS S3 Bucket Creation: An AWS user creates a new S3 bucket using the `CreateBucket` API call.
- Azure Blob Storage Container Creation: A user creates a new container in Azure Blob Storage using the `Create Container` operation.
- Google Cloud Storage Bucket Creation: A Google Cloud user creates a new bucket using `storage.buckets.create`.
- OpenStack Swift Container Creation: A user creates a new container in OpenStack Swift using the `PUT` method.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: AWS:CloudTrail
channel: CreateBucket