{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1526","id":"T1526","name":"Cloud Service Discovery","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1526","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"c24a81f48b1a8b087fedaeaf230edb526a62b87a9fce17872df26bd476d92d67","description":"An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Entra ID, etc. They may also include security services, such as AWS GuardDuty and Microsoft Defender for Cloud, and logging services, such as AWS CloudTrail and Google Cloud Audit Logs.\n\nAdversaries may attempt to discover information about the services enabled throughout the environment. Azure tools and APIs, such as the Microsoft Graph API and Azure Resource Manager API, can enumerate resources and services, including applications, management groups, resources and policy definitions, and their relationships that are accessible by an identity.(Citation: Azure - Resource Manager API)(Citation: Azure AD Graph API)\n\nFor example, Stormspotter is an open source tool for enumerating and constructing a graph for Azure resources and services, and Pacu is an open source AWS exploitation framework that supports several methods for discovering cloud services.(Citation: Azure - Stormspotter)(Citation: GitHub Pacu)\n\nAdversaries may use the information gained to shape follow-on behaviors, such as targeting data or credentials from enumerated services or evading identified defenses through [Disable or Modify Tools](https://attack.mitre.org/techniques/T1685) or [Disable or Modify Cloud Log](https://attack.mitre.org/techniques/T1685/002).","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1526","external_id":"T1526"},{"source_name":"Azure AD Graph API","description":"Microsoft. (2016, March 26). Operations overview | Graph API concepts. Retrieved June 18, 2020.","url":"https://docs.microsoft.com/en-us/previous-versions/azure/ad/graph/howto/azure-ad-graph-api-operations-overview"},{"source_name":"Azure - Resource Manager API","description":"Microsoft. (2019, May 20). Azure Resource Manager. Retrieved June 17, 2020.","url":"https://docs.microsoft.com/en-us/rest/api/resources/"},{"source_name":"Azure - Stormspotter","description":"Microsoft. (2020). Azure Stormspotter GitHub. Retrieved June 17, 2020.","url":"https://github.com/Azure/Stormspotter"},{"source_name":"GitHub Pacu","description":"Rhino Security Labs. (2019, August 22). Pacu. Retrieved October 17, 2019.","url":"https://github.com/RhinoSecurityLabs/pacu"}],"platforms":["IaaS","Identity Provider","Office Suite","SaaS"],"environments":["cloud","identity","onprem","saas"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0083","name":"Cloud Service Enumeration","page":"telemetry/DC0083/","kind":"attack_component","category":"Cloud control plane","description":"Enumeration of available cloud services or their configuration.","collection_focus":"Collect supported list/describe administrative APIs and retain caller and queried service scope; confirm read-event retention.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["actor","service","action","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0083","collector":"illustrative-lab-collector","observation":{"actor":"lab-reader","service":"lab-monitoring","action":"list_resources","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."},{"id":"DC0067","name":"Logon Session Creation","page":"telemetry/DC0067/","kind":"attack_component","category":"Windows and directory audit","description":"Creation of a logon session with account and logon-type context.","collection_focus":"Enable Audit Logon and collect successful session creation on the receiving host; join session/logon IDs rather than only account names.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["account","logon_id","logon_type","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0067","collector":"illustrative-lab-collector","observation":{"account":"LAB\\analyst","logon_id":"0x12345","logon_type":3,"source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0013","name":"User Account Metadata","page":"telemetry/DC0013/","kind":"attack_component","category":"Host state and inventory","description":"Account inventory and attributes at a point in time.","collection_focus":"Export an authorized directory/account inventory with stable IDs, roles, enabled state and collection time; compare snapshots without exposing credentials.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["account_id","enabled","roles","inventory_time"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0013","collector":"illustrative-lab-collector","observation":{"account_id":"user-lab-1","enabled":true,"roles":["lab-reader"],"inventory_time":"2026-09-27T12:00:00Z"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."}],"detection":{"key":"enterprise/T1526","id":"T1526","name":"Cloud Service Discovery","domain":"enterprise","platforms":["IaaS","Identity Provider","Office Suite","SaaS"],"environments":["cloud","identity","onprem","saas"],"source_url":"https://attack.mitre.org/techniques/T1526","technique_page":"techniques/enterprise/T1526/","page":"detections/enterprise/T1526/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[{"id":"f8ed0e8f-7438-4b79-85eb-f358ef2fbebd","title":"Github Self Hosted Runner Changes Detected","status":"test","level":"low","logsource":{"product":"github","service":"audit","definition":"Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"},"data_path":"data/detection-rules/f8ed0e8f-7438-4b79-85eb-f358ef2fbebd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/github/audit/github_self_hosted_runner_changes_detected.yml","author":"Muhammad Faisal (@faisalusuf)","kind":"sigma"},{"id":"35b781cc-1a08-4a5a-80af-42fd7c315c6b","title":"Discovery Using AzureHound","status":"test","level":"high","logsource":{"product":"azure","service":"signinlogs"},"data_path":"data/detection-rules/35b781cc-1a08-4a5a-80af-42fd7c315c6b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/signin_logs/azure_ad_azurehound_discovery.yml","author":"Janantha Marasinghe","kind":"sigma"},{"id":"38646daa-e78f-4ace-9de0-55547b2d30da","title":"PUA - Seatbelt Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/38646daa-e78f-4ace-9de0-55547b2d30da.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_seatbelt.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0402","name":"Detection Strategy for Cloud Service Discovery","url":"https://attack.mitre.org/detectionstrategies/DET0402","stix_id":"x-mitre-detection-strategy--a9351ea0-8379-47cd-a5c5-c5cf424249ef","relationship_id":"relationship--a3610e91-2e89-4205-b285-adcccd7c3974","description":"","analytics":[{"id":"AN1127","name":"Analytic 1127","guidance":"Unusual enumeration of services and resources through cloud APIs such as AWS CLI `describe-*`, Azure Resource Manager queries, or GCP project listings. Defender perspective includes anomalous API calls, unexpected volume of service enumeration, and correlation of discovery with recently compromised sessions.","url":"https://attack.mitre.org/detectionstrategies/DET0402#AN1127","platforms":["IaaS"],"tuning":[{"field":"EnumerationRateThreshold","description":"Rate of API calls used to enumerate services; tuned to reduce noise from automated inventory tools."},{"field":"UserAgentFilter","description":"Expected user agents for cloud management tools; deviations may indicate adversarial tools."}],"log_sources":[{"component_id":"DC0083","component":"Cloud Service Enumeration","name":"AWS:CloudTrail","channel":"DescribeInstances, DescribeServices, ListFunctions: High frequency enumeration calls or unusual user agents performing discovery","platforms":["IaaS"],"analytic_id":"AN1127","source_url":"https://attack.mitre.org/detectionstrategies/DET0402#AN1127","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0083/"},{"component_id":"DC0013","component":"User Account Metadata","name":"AWS:CloudTrail","channel":"AssumeRole: Discovery actions tied to assumed identities outside of normal context","platforms":["IaaS"],"analytic_id":"AN1127","source_url":"https://attack.mitre.org/detectionstrategies/DET0402#AN1127","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0013/"}]},{"id":"AN1128","name":"Analytic 1128","guidance":"Enumeration of directories, applications, or service principals through APIs such as Microsoft Graph or Okta API. Defender perspective includes unexpected listing of users, roles, applications, and abnormal access to identity management endpoints.","url":"https://attack.mitre.org/detectionstrategies/DET0402#AN1128","platforms":["Identity Provider"],"tuning":[{"field":"QueryVolumeThreshold","description":"Threshold for number of object enumeration calls before triggering detection."},{"field":"PrivilegedRoleList","description":"High-value identity roles (Global Admin, Application Admin) for targeted discovery monitoring."}],"log_sources":[{"component_id":"DC0083","component":"Cloud Service Enumeration","name":"azure:audit","channel":"ListApplications, ListServicePrincipals: Large-scale queries against identity or application objects","platforms":["Identity Provider"],"analytic_id":"AN1128","source_url":"https://attack.mitre.org/detectionstrategies/DET0402#AN1128","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0083/"},{"component_id":"DC0067","component":"Logon Session Creation","name":"azure:signinlogs","channel":"InteractiveUserLogin: Discovery behavior linked to privileged logins from atypical IP ranges","platforms":["Identity Provider"],"analytic_id":"AN1128","source_url":"https://attack.mitre.org/detectionstrategies/DET0402#AN1128","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"}]},{"id":"AN1129","name":"Analytic 1129","guidance":"Discovery of SaaS services connected to productivity platforms (e.g., Microsoft 365, Google Workspace). Defender perspective includes unexpected enumeration of enabled services, API integrations, or OAuth applications tied to user accounts.","url":"https://attack.mitre.org/detectionstrategies/DET0402#AN1129","platforms":["Office Suite"],"tuning":[{"field":"MonitoredAppIntegrations","description":"Specific Office Suite applications or plugins that may be enumerated or targeted."},{"field":"GeoLocationDeviation","description":"Geographic deviation threshold for discovery actions linked to recent logins."}],"log_sources":[{"component_id":"DC0083","component":"Cloud Service Enumeration","name":"m365:unified","channel":"Get-MsolServicePrincipal, ListAppRoles: Service discovery operations executed by accounts not normally performing administrative tasks","platforms":["Office Suite"],"analytic_id":"AN1129","source_url":"https://attack.mitre.org/detectionstrategies/DET0402#AN1129","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0083/"},{"component_id":"DC0067","component":"Logon Session Creation","name":"m365:signinlogs","channel":"UserLogin: Discovery operations shortly after account logins from new geolocations","platforms":["Office Suite"],"analytic_id":"AN1129","source_url":"https://attack.mitre.org/detectionstrategies/DET0402#AN1129","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"}]},{"id":"AN1130","name":"Analytic 1130","guidance":"Discovery of connected SaaS applications, APIs, or configurations within platforms like Salesforce, Slack, or Zoom. Defender perspective includes enumeration of available integrations, abnormal querying of service metadata, and follow-on attempts to exploit or persist via discovered services.","url":"https://attack.mitre.org/detectionstrategies/DET0402#AN1130","platforms":["SaaS"],"tuning":[{"field":"IntegrationDiscoveryThreshold","description":"Number of SaaS integrations enumerated before triggering detection."},{"field":"ServiceAccountScope","description":"Expected permissions for service accounts to distinguish benign from malicious discovery."}],"log_sources":[{"component_id":"DC0083","component":"Cloud Service Enumeration","name":"saas:adminapi","channel":"ListIntegrations, ListServices: Repeated service discovery requests from accounts without administrative responsibilities","platforms":["SaaS"],"analytic_id":"AN1130","source_url":"https://attack.mitre.org/detectionstrategies/DET0402#AN1130","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0083/"},{"component_id":"DC0067","component":"Logon Session Creation","name":"saas:auth","channel":"Login, TokenGranted: Discovery actions tied to anomalous login sessions or tokens","platforms":["SaaS"],"analytic_id":"AN1130","source_url":"https://attack.mitre.org/detectionstrategies/DET0402#AN1130","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"}]}]}],"telemetry_references":[{"id":"DC0083","name":"Cloud Service Enumeration","tag":"Cloud Service Enumeration","page":"telemetry/DC0083/","kind":"attack_component"},{"id":"DC0067","name":"Logon Session Creation","tag":"Logon Session Creation","page":"telemetry/DC0067/","kind":"attack_component"},{"id":"DC0013","name":"User Account Metadata","tag":"User Account Metadata","page":"telemetry/DC0013/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0677","name":"AADInternals","page":"tools/S0677/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1091","name":"Pacu","page":"tools/S1091/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0684","name":"ROADTools","page":"tools/S0684/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S9009","name":"TruffleHog","page":"tools/S9009/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0677","name":"AADInternals","page":"tools/S0677/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1091","name":"Pacu","page":"tools/S1091/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0684","name":"ROADTools","page":"tools/S0684/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S9009","name":"TruffleHog","page":"tools/S9009/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0677","name":"AADInternals","url":"https://attack.mitre.org/software/S0677","kind":"tool","description":"[AADInternals](https://attack.mitre.org/software/S0677) can enumerate information about a variety of cloud services, such as Office 365 and Sharepoint instances or OpenID Configurations.(Citation: AADInternals Documentation)","relationship_id":"relationship--16c64146-61e6-4be5-bdc3-1fa97870a080","references":[{"source_name":"AADInternals Documentation","description":"Dr. Nestori Syynimaa. (2018, October 25). AADInternals. Retrieved February 18, 2022.","url":"https://o365blog.com/aadinternals"}]},{"id":"S0684","name":"ROADTools","url":"https://attack.mitre.org/software/S0684","kind":"tool","description":"[ROADTools](https://attack.mitre.org/software/S0684) can enumerate Azure AD applications and service principals.(Citation: Roadtools)\t","relationship_id":"relationship--3c9a5581-9199-4612-8840-06844b23cd1d","references":[{"source_name":"Roadtools","description":"Dirk-jan Mollema. (2020, April 16). Introducing ROADtools - The Azure AD exploration framework. Retrieved January 31, 2022.","url":"https://dirkjanm.io/introducing-roadtools-and-roadrecon-azure-ad-exploration-framework/"}]},{"id":"S1091","name":"Pacu","url":"https://attack.mitre.org/software/S1091","kind":"tool","description":"[Pacu](https://attack.mitre.org/software/S1091) can enumerate AWS services, such as CloudTrail and CloudWatch.(Citation: GitHub Pacu)","relationship_id":"relationship--7a980213-1df8-481f-af86-ed105781c573","references":[{"source_name":"GitHub Pacu","description":"Rhino Security Labs. (2019, August 22). Pacu. Retrieved October 17, 2019.","url":"https://github.com/RhinoSecurityLabs/pacu"}]},{"id":"S9009","name":"TruffleHog","url":"https://attack.mitre.org/software/S9009","kind":"tool","description":"[TruffleHog](https://attack.mitre.org/software/S9009) has the ability to scan code repositories and CI/CD platforms.(Citation: Black Hills Information Security TruffleHog January 2024)(Citation: Github TruffleSecurity Trufflehog April 2025)","relationship_id":"relationship--76b8a9ab-e5e1-4809-bd5f-9235d9a24de9","references":[{"source_name":"Black Hills Information Security TruffleHog January 2024","description":"Chris Traynor. (2024, January 18). Rooting For Secrets with TruffleHog. Retrieved April 15, 2026.","url":"https://www.blackhillsinfosec.com/rooting-for-secrets-with-trufflehog/"},{"source_name":"Github TruffleSecurity Trufflehog April 2025","description":"Trufflesecurity. (2026, April 8). TruffleHog Enterprise. Retrieved April 15, 2026.","url":"https://github.com/trufflesecurity/trufflehog"}]},{"id":"S9041","name":"TeamPCP Cloud Stealer","url":"https://attack.mitre.org/software/S9041","kind":"malware","description":"[TeamPCP Cloud Stealer](https://attack.mitre.org/software/S9041) can search GitHub for Actions runner processes.(Citation: Aqua Security Blog Trivy Compromise APR 2026)(Citation: Aqua Security Trivy Compromise MAR 2026)(Citation: Wiz Trivy Compromise MAR 2026)(Citation: Wiz TeamPCP KICS MAR 2026)","relationship_id":"relationship--e2eb45c9-a5ce-4513-91e0-c88a7f585805","references":[{"source_name":"Aqua Security Trivy Compromise MAR 2026","description":"Aqua Security . (2026, March 21). Trivy ecosystem supply chain temporarily compromised. Retrieved July 1, 2026.","url":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23"},{"source_name":"Aqua Security Blog Trivy Compromise APR 2026","description":"Aqua Team. (2026, April 1). Update: Ongoing Investigation and Continued Remediation. Retrieved July 1, 2026.","url":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"},{"source_name":"Wiz Trivy Compromise MAR 2026","description":"McCarthy, R. (2026, March 20). Trivy Compromised: Everything You Need to Know about the Latest Supply Chain Attack. Retrieved July 1, 2026.","url":"https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack"},{"source_name":"Wiz TeamPCP KICS MAR 2026","description":"McCarthy, R., Haughom, J., Read, B. (2026, March 23). KICS GitHub Action Compromised: TeamPCP Strikes Again in Supply Chain Attack. Retrieved July 1, 2026.","url":"https://www.wiz.io/blog/teampcp-attack-kics-github-action"}]}],"actors":[{"id":"G1053","name":"Storm-0501","url":"https://attack.mitre.org/groups/G1053","kind":"intrusion-set","description":"[Storm-0501](https://attack.mitre.org/groups/G1053) has discovered the victim environment’s protections to include Azure policies, resource locks, and Azure Storage immutability policies.(Citation: Microsoft Storm-0501 Embargo Ransomware August 2025)","relationship_id":"relationship--52288e4e-f430-472a-b5aa-f875f1007d73","references":[{"source_name":"Microsoft Storm-0501 Embargo Ransomware August 2025","description":"Microsoft Threat Intelligence. (2025, August 27). Storm-0501’s evolving techniques lead to cloud-based ransomware. Retrieved October 19, 2025.","url":"https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"}]}],"mitigations":[],"candidates":[{"id":"1e40bb1d-195e-401e-a86b-c192f55e005c","name":"Azure - Dump Subscription Data with MicroBurst","platforms":["iaas:azure"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":2,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1526/T1526.yaml","description":"Upon successful execution, this test will enumerate all resources that are contained within a valid Azure subscription. \nThe resources enumerated will display on screen, as well as several csv files and folders will be output to a specified directory, listing what resources were discovered by the script. \nSee https://dev.to/cheahengsoon/enumerating-subscription-information-with-microburst-35a1\n","inputs":{"username":{"description":"Azure AD username","type":"string","default":null},"password":{"description":"Azure AD password","type":"string","default":"T1082Az"},"output_directory":{"description":"Directory to output results to","type":"string","default":"$env:temp\\T1526Test1"},"subscription_name":{"description":"Azure subscription name to scan","type":"string","default":null}},"dependencies":[{"description":"The Get-AzDomainInfo script must exist in PathToAtomicsFolder\\..\\ExternalPayloads.\n"},{"description":"The Az module must be installed.\n"}],"source_definition_sha256":"828c86003d30d87e827bd2bb99f7df654c26f021814f7a9cebe5ed36ef986803"},{"id":"58f57c8f-db14-4e62-a4d3-5aaf556755d7","name":"Azure - Enumerate common cloud services","platforms":["iaas:azure"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1526/T1526.yaml","description":"Upon successful execution, this test will enumerate common resources that are contained within a valid Azure subscription.\n","inputs":{"client_id":{"description":"Azure AD client ID","type":"string","default":null},"client_secret":{"description":"Azure AD client secret","type":"string","default":null},"tenant_id":{"description":"Azure AD tenant ID","type":"string","default":null},"cloud":{"description":"Azure cloud environment","type":"string","default":"AzureCloud"},"output_directory":{"description":"Directory to output results to","type":"string","default":"$env:TMPDIR/azure_discovery"}},"dependencies":[{"description":"The Az module must be installed.\n"}],"source_definition_sha256":"e4f4ef4d1bb85b50ff1961be6e921ae93dfea6397d71b0608ebfda89ec111b2e"},{"id":"aa8b9bcc-46fa-4a59-9237-73c7b93a980c","name":"AWS - Enumerate common cloud services","platforms":["iaas:aws"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1526/T1526.yaml","description":"Upon successful execution, this test will enumerate common resources that are contained within a valid AWS account.\n","inputs":{"access_key":{"description":"AWS Access Key","type":"string","default":""},"secret_key":{"description":"AWS Secret Key","type":"string","default":""},"session_token":{"description":"AWS Session Token","type":"string","default":""},"profile":{"description":"AWS profile","type":"string","default":""},"regions":{"description":"AWS regions","type":"string","default":"us-east-1,us-east-2,us-west-1,us-west-2"},"output_directory":{"description":"Directory to output results to","type":"string","default":"$env:TMPDIR/aws_discovery"}},"dependencies":[{"description":"The AWS PowerShell module must be installed.\n"}],"source_definition_sha256":"e063f37495480636d175c8c2df46519dda3754c804971b0d8ad11d06d39ed488"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1685":"/ttp-simulation/techniques/enterprise/T1685/","T1685.002":"/ttp-simulation/techniques/enterprise/T1685.002/","T1526":"/ttp-simulation/techniques/enterprise/T1526/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1526","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0083","collector":"illustrative-lab-collector","observation":{"actor":"lab-reader","service":"lab-monitoring","action":"list_resources","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0067","collector":"illustrative-lab-collector","observation":{"account":"LAB\\analyst","logon_id":"0x12345","logon_type":3,"source_ip":"192.0.2.10"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0013","collector":"illustrative-lab-collector","observation":{"account_id":"user-lab-1","enabled":true,"roles":["lab-reader"],"inventory_time":"2026-09-27T12:00:00Z"}}]}}