DC0027 Cloud Storage Metadata
| Item | Value |
|---|---|
| ID | DC0027 |
| Version | 2.0 |
| Created | 20 October 2021 |
| Last Modified | 12 November 2025 |
Log Sources
| Name | Channel |
|---|---|
| AWS:CloudTrail | Post-authentication metadata enumeration from GUI session |
| m365:unified | AnonymousLinkCreated |
| saas:box | collaboration.invite |
| saas:dropbox | Shared link created to external account |
Detection Strategy
| ID | Name | Technique Detected |
|---|---|---|
| DET0573 | Cross-Platform Detection of Data Transfer to Cloud Account | T1537 |
| DET0291 | Detection of Cloud Service Dashboard Usage via GUI-Based Cloud Access | T1538 |