AN1580: Analytic 1580
Detects snapshot sharing, backup exports, or data object transfers from victim-owned cloud accounts to other cloud identities within the same provider (e.g., AWS, Azure) using snapshot sharing, S3 bucket policy updates, or SAS URI generation.
Analyst context for executives and security teams
AN1580 is a cloud detection analytic focused on identifying when data-bearing cloud resources are shared or exported from a victim-owned IaaS account to another identity in the same cloud provider. For leaders, the practical issue is data control: snapshot sharing, backup export, object storage policy changes, or SAS URI creation can move sensitive data outside normal ownership boundaries without requiring traditional malware or endpoint activity.
Executive priority
Prioritize this as a cloud data-governance and incident-readiness question: can the organization prove who shared snapshots, backups, or object data, with whom, and whether that sharing was approved? This matters for business continuity, breach scoping, compliance evidence, and cloud security budget decisions because the decisive controls are usually identity governance, cloud logging, storage configuration monitoring, and rapid revocation procedures.
Technical view
SOC and cloud detection teams should validate visibility across IaaS control-plane activity involving snapshot sharing, backup exports, object storage policy updates, and SAS URI generation. Because ATT&CK provides no detection logic for this analytic, teams should build or tune detections around changes that grant access to external or unexpected cloud identities, especially when the source resource is owned by the protected account. IR teams should ensure runbooks can identify the affected resource, recipient identity, time of sharing, actor identity, and whether the share/export remains active.
Likely telemetry
- Cloud provider control-plane audit logs for IaaS resource sharing and storage configuration changes
- Snapshot and backup service activity logs showing share, export, or permission modification events
- Object storage policy and access-control change logs, including bucket policy updates
- SAS URI generation or equivalent temporary access token creation records where available
- Cloud identity and access management logs linking the actor identity to the sharing or export action
Detection direction
- Validate that logging is enabled for the relevant IaaS accounts and services where snapshots, backups, object storage policies, and SAS-style access mechanisms are used.
- Alert on data-resource sharing or export to cloud identities outside expected administrative, backup, or replication patterns.
- Correlate sharing events with the actor identity, source IP/session context, resource sensitivity, and recent permission changes to reduce false positives from legitimate operations.
- Tune allowlists carefully for approved backup, disaster recovery, migration, and cross-account/cloud administration workflows; these are likely sources of benign matches.
- Check for blind spots where audit logs do not capture generated access URIs, policy diffs, recipient identities, or short-lived access grants.
Mitigation priorities
- Establish approved patterns for snapshot sharing, backup export, object storage policy changes, and temporary access URI generation.
- Restrict who can create or modify data-sharing permissions using least privilege and separation of duties.
- Continuously inventory sensitive cloud data resources and their sharing state so unauthorized exposure can be identified quickly.
- Require logging, retention, and alerting for cloud control-plane changes affecting data access.
- Create incident response procedures to revoke shares, disable temporary access, preserve audit evidence, and assess what data may have been accessible.
Analyst notes and limits
This object is an ATT&CK detection analytic for IaaS environments, external ID AN1580, describing detection of snapshot sharing, backup exports, and data object transfers to other cloud identities within the same provider. The official object does not provide detailed detection logic, tactics, labels, aliases, or relationship context, so this take emphasizes validation questions and evidence classes rather than specific rule syntax.
The source fields do not identify specific ATT&CK tactics, techniques, relationships, data components, or a complete detection algorithm. Examples mention AWS and Azure, but the supplied platform is broadly IaaS; local cloud services, logging configuration, naming conventions, approved cross-account workflows, and compliance requirements are needed to determine precise coverage and severity.
Analytic 1580
Detects snapshot sharing, backup exports, or data object transfers from victim-owned cloud accounts to other cloud identities within the same provider (e.g., AWS, Azure) using snapshot sharing, S3 bucket policy updates, or SAS URI generation.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | 31129a0c3606… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN1580Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.