Applied Cybernetics Group
T1526 Cloud Service Discovery
- Technique
T1526- Tactics
- Discovery
- Research, 90 days
- 3
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 3
- Elastic, Splunk
- 33
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1526
MITRE description
An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Entra ID, etc. They may also include security services, such as AWS GuardDuty and Microsoft Defender for Cloud, and logging services, such as AWS CloudTrail and Google Cloud Audit Logs. Adversaries may attempt to discover information about the services enabled throughout the environment. Azure tools and APIs, such as the Microsoft Graph API and Azure Resource Manager API, can enumerate resources and services, including applications, management groups, resources and policy definitions, and their relationships that are accessible by an identity.(Citation: Azure - Resource Manager API)(Citation: Azure AD Graph API) For example, Stormspotter is an open source tool for enumerating and constructing a graph for Azure resources and services, and Pacu is an open source AWS exploitation framework that supports several methods for discovering cloud services.(Citation: Azure - Stormspotter)(Citation: GitHub Pacu) Adversaries may use the information gained to shape follow-on behaviors, such as targeting data or credentials from enumerated services or evading identified defenses through [Disable or Modify Tools](https://attack.mitre.org/techniques/T1685) or [Disable or Modify Cloud Log](https://attack.mitre.org/techniques/T1685/002).
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-10-26Huntress: AI, Scripts, Operator: Inside the ConnectWise Attack -
2026-09-25Microsoft Threat Intelligence: Storm-3168: Agentic-driven cloud attacks using compromised service principals -
2026-09-16Datadog Security Labs: Mapping out your unknown: A threat hunter’s guide to GitHub
Detection coverage
SigmaHQ community rules
- Github Self Hosted Runner Changes Detected (core)
- Discovery Using AzureHound (core)
- PUA - Seatbelt Execution (core)
Elastic and Splunk rules
- AWS Control Plane Access by Suspicious Process (elastic)
- Anthropic Excessive Chat Access Failures (elastic)
- AWS Backup Resource Enumeration via Long-Term Access Key (elastic)
- AWS Bedrock Foundation Model Enumeration Followed by Invocation via Long-Term Key (elastic)
- AWS Discovery API Calls via CLI from a Single Resource (elastic)
- AWS Discovery API Calls from VPN ASN for the First Time by Identity (elastic)
- AWS S3 Rapid Bucket Posture API Calls from a Single Principal (elastic)
- AWS Service Quotas Multi-Region GetServiceQuota Requests (elastic)
- AWS SES Enumeration via Long-Term Access Key (elastic)
- AWS Lateral Movement from Kubernetes SA via AssumeRoleWithWebIdentity (elastic)
- Spike in AWS Error Messages (elastic)
- Rare AWS Error Code (elastic)
- Entra ID OAuth Device Code Sign-in to Azure AD Graph Enumeration (elastic)
- Azure AD Graph High 4xx Error Ratio from User (elastic)
- Azure AD Graph Potential Enumeration (ROADrecon) (elastic)
- Azure AD Graph Access with Suspicious User-Agent (elastic)
- Entra ID Sign-in BloodHound Suite User-Agent Detected (elastic)
- Entra ID Sign-in TeamFiltration User-Agent Detected (elastic)
- Entra ID Managed Device Client Sign-In to Graph Enumeration (elastic)
- Microsoft Graph Multi-Category Reconnaissance Burst (elastic)
- Spike in Azure Activity Logs Failed Messages (elastic)
- Rare Azure Activity Logs Event Failures (elastic)
- GCP Secret Manager ListSecrets Across Multiple Projects (elastic)
- Spike in GCP Audit Failed Messages (elastic)
- Rare GCP Audit Failure Event Code (elastic)
Showing 25 of 33.