Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service.
.claude/skills/cyberstrikeus-t1537-transfer-data-to-cloud-account/SKILL.md| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-07 | ✗→✓ | ▲ Improved | 36% | 0% |
| case-08 | ✗→✓ | ▲ Improved | 167% | 0% |
| case-16 | ✗→✓ | ▲ Improved | -57% | 0% |
| case-17 | ✗→✓ | ▲ Improved | -34% | 0% |
| case-20 | ✗→✓ | ▲ Improved | -32% | 0% |
Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service.
A defender who is monitoring for large transfers to outside the cloud environment through normal file transfers or over command and control channels may not be watching for data transfers to another account within the same cloud provider. Such transfers may utilize existing cloud provider APIs and the internal address space of the cloud provider to blend into normal traffic or avoid data transfers over external network interfaces.
Adversaries may also use cloud-native mechanisms to share victim data with adversary-controlled cloud accounts, such as creating anonymous file sharing links or, in Azure, a shared access signature (SAS) URI.
Incidents have been observed where adversaries have created backups of cloud instances and transferred them to separate accounts.
Platforms: IaaS, Office Suite, SaaS
> Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
Data loss prevention can prevent and block sensitive data from being shared with individuals outside an organization.
Limit user account and IAM policies to the least privileges required.
Configure appropriate data sharing restrictions in cloud services. For example, external sharing in Microsoft SharePoint and Google Drive can be turned off altogether, blocked for certain domains, or restricted to certain users.
Implement network-based filtering restrictions to prohibit data transfers to untrusted VPCs.
| Finding | Severity | Impact | | --------------------------------------------------- | -------- | ------------ | | Transfer Data to Cloud Account technique applicable | Low | Exfiltration |
| CWE ID | Title | | ------- | --------------------------------- | | CWE-200 | Exposure of Sensitive Information |
| Case | Status | Duration (ms) | Turns | Tokens | Tool calls | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Without | With | Δ | Without | With | Δ | Without | With | Δ | Without | With | Δ | ||
case-01 | fail→fail | 32,303 | 33,064 | +2% | 1 | 1 | 0% | 4,419 | 5,574 | +26% | 0 | 0 | — |
case-02 | fail→fail | 34,550 | 37,046 | +7% | 1 | 1 | 0% | 4,345 | 6,553 | +51% | 0 | 0 | — |
case-03 | fail→fail | 38,494 | 39,520 | +3% | 1 | 1 | 0% | 5,218 | 6,707 | +29% | 0 | 0 | — |
case-04 | pass→pass | 18,214 | 19,506 | +7% | 1 | 1 | 0% | 2,174 | 3,312 | +52% | 0 | 0 | — |
case-05 | pass→pass | 18,445 | 21,396 | +16% | 1 | 1 | 0% | 2,297 | 3,781 | +65% | 0 | 0 | — |
case-06 | pass→pass | 11,041 | 14,574 | +32% | 1 | 1 | 0% | 1,957 | 2,594 | +33% | 0 | 0 | — |
case-07 | fail→pass | 10,889 | 6,936 | -36% | 1 | 1 | 0% | 1,012 | 1,377 | +36% | 0 | 0 | — |
case-08 | fail→pass | 13,960 | 18,868 | +35% | 1 | 1 | 0% | 1,271 | 3,392 | +167% | 0 | 0 | — |
case-09 | pass→pass | 21,318 | 7,304 | -66% | 1 | 1 | 0% | 3,024 | 1,402 | -54% | 0 | 0 | — |
case-10 | fail→fail | 17,918 | 17,438 | -3% | 1 | 1 | 0% | 2,292 | 2,890 | +26% | 0 | 0 | — |
case-11 | pass→pass | 15,106 | 7,088 | -53% | 1 | 1 | 0% | 1,658 | 1,301 | -22% | 0 | 0 | — |
case-12 | pass→pass | 9,983 | 2,873 | -71% | 1 | 1 | 0% | 1,385 | 1,503 | +9% | 0 | 0 | — |
case-13 | pass→pass | 12,006 | 8,320 | -31% | 1 | 1 | 0% | 1,970 | 1,621 | -18% | 0 | 0 | — |
case-14 | pass→pass | 9,942 | 8,776 | -12% | 1 | 1 | 0% | 902 | 1,354 | +50% | 0 | 0 | — |
case-15 | pass→pass | 14,366 | 1,993 | -86% | 1 | 1 | 0% | 2,323 | 1,333 | -43% | 0 | 0 | — |
case-16 | fail→pass | 18,839 | 2,599 | -86% | 1 | 1 | 0% | 3,291 | 1,399 | -57% | 0 | 0 | — |
case-17 | fail→pass | 13,006 | 3,292 | -75% | 1 | 1 | 0% | 2,200 | 1,441 | -35% | 0 | 0 | — |
case-18 | pass→pass | 16,653 | 7,187 | -57% | 1 | 1 | 0% | 2,059 | 1,367 | -34% | 0 | 0 | — |
case-19 | fail→fail | 18,449 | 14,528 | -21% | 1 | 1 | 0% | 2,223 | 2,709 | +22% | 0 | 0 | — |
case-20 | fail→pass | 28,370 | 10,663 | -62% | 1 | 1 | 0% | 2,802 | 1,900 | -32% | 0 | 0 | — |
case-21 | fail→pass | 21,435 | 6,843 | -68% | 1 | 1 | 0% | 3,163 | 1,246 | -61% | 0 | 0 | — |
case-22 | pass→pass | 15,140 | 6,998 | -54% | 1 | 1 | 0% | 1,448 | 1,408 | -3% | 0 | 0 | — |
case-23 | pass→pass | 12,126 | 3,975 | -67% | 1 | 1 | 0% | 1,182 | 1,518 | +28% | 0 | 0 | — |
case-24 | pass→pass | 15,558 | 12,633 | -19% | 1 | 1 | 0% | 1,447 | 2,139 | +48% | 0 | 0 | — |
case-25 | pass→pass | 21,623 | 21,784 | +1% | 1 | 1 | 0% | 2,403 | 3,396 | +41% | 0 | 0 | — |
case-26 | pass→pass | 9,127 | 6,419 | -30% | 1 | 1 | 0% | 636 | 1,197 | +88% | 0 | 0 | — |
DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 26 cases were attempted. The headline lift of +23 percentage points is the difference between those two pass rates over the 26 comparable cases.
Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.
Other measured skills in the registry, with their headline benchmark lift.