Lesson 95 — The Cloud Data Started Leaving
The attacker had moved through the environment.
Then cloud activity spiked.
Files were downloaded in bulk.
Now the data was moving too.
The incident has reached the data.
Correlate identity, cloud access, file activity and transfer behaviour.
Case briefing
Investigation objective
Determine what cloud data was accessed, whether the activity represents legitimate use or exfiltration, and how the cloud evidence connects to the existing incident.
Investigator's rule
Do not confuse access to data with proof that data left the organisation.
Stage 1 — establish the cloud pivot
| Known evidence | Cloud question |
|---|---|
| Compromised identity | Which cloud services did it access? |
| Successful attacker activity | What happened after authentication? |
| Lateral movement | Did access expand to sensitive resources? |
| Bulk file activity | Was the volume normal for this user? |
Start with the compromised identity
Use the account already linked to the incident as the primary pivot into Microsoft 365 and other cloud activity.
Preserve the timeline
Position cloud activity against the phishing, identity and endpoint stages so you can see whether it represents attack progression.
Stage 2 — review cloud activity
let User = "alex@contoso.com";
CloudAppEvents
| where Timestamp > ago(4h)
| where AccountId =~ User
| project Timestamp,
AccountId,
Application,
ActionType,
IPAddress,
ObjectName,
RawEventData
| order by Timestamp ascAsk what the session did
Authentication tells you access occurred. Cloud activity tells you whether the session browsed, searched, opened, downloaded, changed or shared information.
Look across services
Review relevant SharePoint, OneDrive, Exchange and other available cloud telemetry rather than assuming the activity stayed in one workload.
Stage 3 — build the data timeline
Sequence changes meaning
A single file download may be ordinary. Discovery followed by concentrated access and bulk downloads can tell a very different story.
Identify collection behaviour
Attackers may search, enumerate or gather information before moving it. Those preparatory actions belong in the incident timeline.
Stage 4 — measure the activity
let User = "alex@contoso.com";
CloudAppEvents
| where Timestamp > ago(4h)
| where AccountId =~ User
| summarize
Events=count(),
FirstSeen=min(Timestamp),
LastSeen=max(Timestamp)
by Application, ActionType, IPAddress
| order by Events descVolume needs a baseline
“Large” only has meaning relative to expected behaviour. Compare the user, role, service and historical activity where suitable telemetry is available.
Quantity is not everything
A small number of highly sensitive files may matter more than thousands of low-value objects. Include business context in the assessment.
Stage 5 — access versus exfiltration
| Evidence | What it supports |
|---|---|
| File viewed | Data access |
| File downloaded | Transfer to the authenticated client or session |
| Bulk download | Potential collection or exfiltration |
| External sharing change | Potential alternate exfiltration path |
| Known external destination | Stronger evidence of data leaving organisational control |
Use precise language
If telemetry confirms downloads but not the final destination, say exactly that. Do not claim confirmed external exfiltration without supporting evidence.
Downloaded does not always mean stolen
Legitimate sync clients and user workflows can move data. The compromised identity and incident context make validation essential.
Stage 6 — identify sensitive resources
Business impact enters the case
The sensitivity and purpose of accessed information can affect incident severity, escalation and notification requirements.
Bring in data owners when needed
SOC analysts can identify objects and activity, while business or data owners may be needed to determine real sensitivity and operational impact.
Stage 7 — scope related cloud activity
let SuspiciousIP = "203.0.113.42";
CloudAppEvents
| where Timestamp > ago(4h)
| where IPAddress == SuspiciousIP
| summarize
Actions=count(),
FirstSeen=min(Timestamp),
LastSeen=max(Timestamp)
by AccountId, Application
| order by Actions descScope infrastructure too
If the same suspicious source accessed other accounts or services, the cloud scope may be larger than the first compromised user.
Expect infrastructure to change
Do not depend only on one IP address. Use time, behaviour, identities, applications and other evidence to find related activity.
Stage 8 — contain the data path
Contain active access
If the attacker still has a valid session or another access path, containment must prevent continued cloud activity as quickly as operationally appropriate.
Preserve audit evidence
Retain the cloud activity needed to establish what was accessed, when it happened, which identity performed it and what followed.
Stage 9 — incident finding
Separate fact from impact assessment
The investigation may prove that files were downloaded before it can prove where they ultimately went. Record the confirmed evidence and the unresolved question.
Escalate when impact demands it
Sensitive data exposure may require incident leadership, legal, privacy, compliance and business stakeholders according to organisational procedures.
Decision point
Do not outrun the evidence
Urgency matters, but so does accuracy. Describe confirmed access, transfer and external movement only at the level the telemetry supports.
The incident is now business-impacting
Once sensitive information may have been exposed, the investigation is no longer only a technical security problem.
Lesson 95 key takeaways
- Pivot from the compromised identity into cloud activity.
- Place cloud actions into the existing incident timeline.
- Look across relevant cloud services rather than one workload only.
- Distinguish discovery, collection, access and transfer behaviour.
- Compare unusual volume against an appropriate baseline.
- Consider data sensitivity as well as quantity.
- Do not equate file access with confirmed exfiltration.
- Use precise language when the final destination is unknown.
- Scope suspicious infrastructure and related identities.
- Contain active identity, endpoint and cloud access paths.
- Preserve audit evidence needed to establish exposure.
- Escalate when potential data impact requires broader stakeholders.
Module 10 — Complete SOC Investigation Scenarios
Lesson 95 followed the incident into cloud data access and possible exfiltration. Lesson 96 raises the stakes again when the compromised identity belongs to an executive.
Continue your SOC Analyst training
🔎 SOC Analyst Academy — Module 10: Complete SOC Investigation Scenarios
How do SOC analysts investigate cloud data exfiltration?
Lesson 95 of the Agent Foskett SOC Analyst Academy follows a multi-stage compromise into cloud services and investigates file access, bulk downloads, sensitive data exposure and possible exfiltration.
Investigating cloud data access and transfer
Learn how to correlate identity and cloud activity, distinguish access from exfiltration, measure abnormal behaviour, identify sensitive resources, scope related accounts and preserve evidence for incident response.
