Poisoned Pipeline / Techniques / T0187
Exposed storage
Cloud Security
Attackers are constantly searching for any data that might help them achieve their malicious goals.
Exposed storage such as S3 buckets are highly values since it might contain sensitive information that can be used to yield an attack.
For example: file system snapshots that might contain code or secrets.
Where this idea came from
Cited from a security article or vendor blog in the original YAML; not a first-party incident report.
- https://www.trendmicro.com/vinfo/es/security/news/virtualization-and-cloud/a-misconfigured-amazon-s3-exposed-almost-50-thousand-pii-in-australia
- https://www.darkreading.com/application-security/cloud-misconfig-exposes-3tb-sensitive-airport-data-amazon-s3-bucket
Mitigations
- M1240 Enable data encryption at rest
- M1260 Implement least privilege access
- M1261 Implement proper access control for cloud storages
- M1550 Implement strict access control for clouds
Detections
- D1510 Implement Intrusion Detection System and anti-malware
- D1260 Implement regular security audit and review
- D1261 Implement penetration testing
- D1262 Implement vulnerability assessment
Identified, not yet observed here. This technique set includes behaviors from pentest research, defender guidance, and analog attacker behavior — not only from named public breaches. No incident in this corpus maps here yet.