Framework mapping
MITRE ATT&CK® Enterprise mapping
Tactics: Exfiltration
Platforms: Windows, Linux, macOS, SaaS
Relationship: detection coverage
Open the official ATT&CK object ↗Editorial mapping of an inherited BMC article to related Enterprise ATT&CK behavior, control, evidence, architecture, or risk context. Mapping roles state the relationship and do not assert equivalence unless labeled direct.
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. Bare Metal Cyber is not affiliated with or endorsed by MITRE.
Related defensive techniques
Inferred and experimental: These relationships are generated from D3FEND graph paths. They are hypotheses for analysis, not proof of prevention, detection, or control effectiveness.
MITRE D3FEND™ and the D3FEND logo are trademarks of The MITRE Corporation. MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation.
What it means
Cloud storage exfiltration detection looks for unusual reads, downloads, copies, sharing changes, presigned access, cross-account movement, and data-transfer patterns.
Why it matters
Cloud data theft may use authorized APIs and credentials, so detection must consider identity, volume, sensitivity, destination, and baseline behavior.
Practical focus
- Enable data-access logging
- Identify sensitive stores and normal access patterns
- Correlate identity, network, and sharing changes
- Test alerting with representative scenarios
Common mistakes
- Monitoring configuration changes but not object access
- Alerting only on large transfers
- Ignoring presigned and delegated access
- Treating every administrative read as normal
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: