Data from Cloud Storage
Collection from cloud storage reads information through managed storage services.
Stored objects are a collection target
Collection from cloud storage accesses information held in managed storage services. Depending on the platform, this may involve object storage, shared documents, or other cloud-hosted files. Access can occur through an application interface, an API, a shared link, or a credential with permission to retrieve the information.
Successful access may be unauthorized even when the service's permission checks accept it. A genuine account can be compromised, a sharing policy can be too broad, or a credential can be exposed. Investigate both the technical authorization and the intended business use.
An unusual burst of document reads
A fictional academy sees many document-access events under a staff identity. The analyst identifies the storage service, tenant, affected resources, requesting principal, time window, and recorded outcomes. They compare the activity with normal work, approved exports, and synchronization jobs.
A client resynchronizing files can generate many reads legitimately. A count alone does not identify malicious collection or the number of unique documents. Check retries, bulk operations, and the service's event semantics before describing the dataset.
The team reviews how the identity reached the storage: direct credentials, an assumed role, delegated application access, or a sharing link. That path determines the relevant containment and follow-up questions.
Verify data-event coverage
Management logs may show policy changes without recording object reads. Cloud audit logs explains why data events and management events answer different questions. Confirm that the relevant events were enabled and retained during the incident period.
If data-read records are missing, do not interpret that absence as proof that no document was accessed. Other application or access records may help, but their coverage and meaning also require review.
Separate collection from Data exfiltration. A storage read establishes an action under the source's semantics; determining where the information subsequently went may require additional evidence. A public exposure window also differs from confirmed access during that window.
Limit continued access
Restrict the abused credential, grant, policy, or link as justified, preserving relevant configuration and events first where practical. Review related resources reachable through the same access path. Removing one shared document does not necessarily revoke a broader application grant.
For practice, compare a scheduled synchronization, an approved bulk export, and unexplained reads by a dormant identity. Identify the evidence distinguishing purpose, scope, and outcome. Write an impact statement that clearly separates confirmed reads, possible exposure, and unknown transfer. Incident response and Incident reporting and handover help turn those findings into coordinated action.
Related concepts
References & further reading
Original explanations, with primary references for deeper study.
MITRE ATT&CK T1530: Data from Cloud Storage