Upload to consumer cloud storage

exfil_cloud_storage_upload

Attempts to upload a synthetic-PII canary to Dropbox, Google Drive, OneDrive, an anonymous file drop and a paste site, using deliberately invalid credentials so nothing can be stored anywhere. What is measured is whether the request reaches the service and whether the body is inspected on the way out.

Severity high how bad it would be if it were real

Expected outcome Something should prevent it

Platforms 3 macOS, Linux, Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

runs in --safe
Observation only. It runs even in the inert mode, because it changes nothing and sends nothing.
sends traffic
Generates outbound traffic. --no-network suppresses it entirely.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1041	Exfiltration Over C2 Channel	Exfiltration	coverage statistics
T1567.002	Exfiltration to Cloud Storage	Exfiltration	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other exfiltration tests

Other tests in the Exfiltration category.
Test	What it does	Severity
DNS tunnelling pattern exfil_dns_tunnel	Issues a burst of long, high-entropy subdomain lookups under a controlled zone — the shape of data being smuggled out inside DNS queries. The data enc…	high
DNS-over-HTTPS resolver bypass exfil_doh_resolution	Resolves a known-bad test domain through public DNS-over-HTTPS resolvers instead of the host's configured resolver, to establish whether DNS filtering…	high
Outbound HTTP POST carrying synthetic PII exfil_http_post_pii	POSTs the synthetic-PII canary to a controlled endpoint over both HTTPS and plain HTTP, so content inspection can be told apart from destination filte…	high
Canary documents with synthetic sensitive data exfil_dlp_canary_documents	Writes documents whose content is what data-loss-prevention rules look for — Luhn-valid but unissued test card numbers, national-ID-shaped strings, AP…	medium

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.