Cloud upload service
Flags data transfer to personal cloud storage or anonymous file-sharing services (mega.nz, WeTransfer, anonfiles, gofile, transfer.sh, file.io, 0x0.st…
What it detects
Flags data transfer to personal cloud storage or anonymous file-sharing services (mega.nz, WeTransfer, anonfiles, gofile, transfer.sh, file.io, 0x0.st, dropbox-uploader). On a managed host this is a common insider data-theft channel and an acceptable-use policy violation, as well as a low-tech exfiltration path that bypasses email DLP. Matches the raw event text, so it works across Windows/Linux/macOS logs.
MITRE ATT&CK mapping
False positives and triage
Some teams legitimately use cloud storage. Alert on unsanctioned services, uploads of sensitive directories, or transfers by non-IT accounts. Scope by the destination service and whether it is on your organization's approved list.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 50%. Source: rules/multi/cloud_exfil_upload.yaml, licensed under the Apache License 2.0.
id: exfiltration.cloud_upload_service
version: 1.0.0
status: experimental
severity: medium
confidence: 0.5
platforms: [windows, linux, macos]
mitre_techniques: [T1567.002, T1048.003]
description: |
Flags data transfer to personal cloud storage or anonymous file-sharing services
(mega.nz, WeTransfer, anonfiles, gofile, transfer.sh, file.io, 0x0.st, dropbox-uploader).
On a managed host this is a common insider data-theft channel and an acceptable-use policy
violation, as well as a low-tech exfiltration path that bypasses email DLP. Matches the raw
event text, so it works across Windows/Linux/macOS logs.
match:
raw_message_contains_any:
- "mega.nz"
- "megatools"
- "wetransfer.com"
- "anonfiles.com"
- "gofile.io"
- "transfer.sh"
- "file.io/"
- "0x0.st"
- "dropbox-uploader"
- "ufile.io"
false_positive_guidance: |
Some teams legitimately use cloud storage. Alert on unsanctioned services, uploads of
sensitive directories, or transfers by non-IT accounts. Scope by the destination service
and whether it is on your organization's approved list.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.