DC0023 Cloud Storage Modification
| Item | Value |
|---|---|
| ID | DC0023 |
| Version | 2.0 |
| Created | 20 October 2021 |
| Last Modified | 12 November 2025 |
Log Sources
| Name | Channel |
|---|---|
| AWS:CloudTrail | PutBucketLifecycle, PutLifecycleConfiguration, SetBucketLifecycle, storage.buckets.update |
| AWS:CloudTrail | PutObject (with SSE-C), UploadPart (SSE-C) |
| AWS:CloudTrail | PutBucketPolicy |
| m365:unified | SharingSet |
| saas:googledrive | drive.permission.add |
Detection Strategy
| ID | Name | Technique Detected |
|---|---|---|
| DET0573 | Cross-Platform Detection of Data Transfer to Cloud Account | T1537 |
| DET0041 | Detection of Lifecycle Policy Modifications for Triggered Deletion in IaaS Cloud Storage | T1485.001 |
| DET0215 | Detection of Multi-Platform File Encryption for Impact | T1486 |