{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1580","id":"T1580","name":"Cloud Infrastructure Discovery","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1580","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"f1a8eec532c859515d52e1013c3f4f3dd3b64379555442f427e1945a2cca0577","description":"An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-service (IaaS) environment. This includes compute service resources such as instances, virtual machines, and snapshots as well as resources of other services including the storage and database services.\n\nCloud providers offer methods such as APIs and commands issued through CLIs to serve information about infrastructure. For example, AWS provides a <code>DescribeInstances</code> API within the Amazon EC2 API that can return information about one or more instances within an account, the <code>ListBuckets</code> API that returns a list of all buckets owned by the authenticated sender of the request, the <code>HeadBucket</code> API to determine a bucket’s existence along with access permissions of the request sender, or the <code>GetPublicAccessBlock</code> API to retrieve access block configuration for a bucket.(Citation: Amazon Describe Instance)(Citation: Amazon Describe Instances API)(Citation: AWS Get Public Access Block)(Citation: AWS Head Bucket) Similarly, GCP's Cloud SDK CLI provides the <code>gcloud compute instances list</code> command to list all Google Compute Engine instances in a project (Citation: Google Compute Instances), and Azure's CLI command <code>az vm list</code> lists details of virtual machines.(Citation: Microsoft AZ CLI) In addition to API commands, adversaries can utilize open source tools to discover cloud storage infrastructure through [Wordlist Scanning](https://attack.mitre.org/techniques/T1595/003).(Citation: Malwarebytes OSINT Leaky Buckets - Hioureas)\n\nAn adversary may enumerate resources using a compromised user's access keys to determine which are available to that user.(Citation: Expel IO Evil in AWS) The discovery of these available resources may help adversaries determine their next steps in the Cloud environment, such as establishing Persistence.(Citation: Mandiant M-Trends 2020)An adversary may also use this information to change the configuration to make the bucket publicly accessible, allowing data to be accessed without authentication. Adversaries have also may use infrastructure discovery APIs such as <code>DescribeDBInstances</code> to determine size, owner, permissions, and network ACLs of database resources. (Citation: AWS Describe DB Instances) Adversaries can use this information to determine the potential value of databases and discover the requirements to access them. Unlike in [Cloud Service Discovery](https://attack.mitre.org/techniques/T1526), this technique focuses on the discovery of components of the provided services rather than the services themselves.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1580","external_id":"T1580"},{"source_name":"Expel IO Evil in AWS","description":"A. Randazzo, B. Manahan and S. Lipton. (2020, April 28). Finding Evil in AWS. Retrieved June 25, 2020.","url":"https://expel.io/blog/finding-evil-in-aws/"},{"source_name":"AWS Head Bucket","description":"Amazon Web Services. (n.d.). AWS HeadBucket. Retrieved February 14, 2022.","url":"https://docs.aws.amazon.com/AmazonS3/latest/API/API_HeadBucket.html"},{"source_name":"AWS Get Public Access Block","description":"Amazon Web Services. (n.d.). Retrieved May 28, 2021.","url":"https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetPublicAccessBlock.html"},{"source_name":"AWS Describe DB Instances","description":"Amazon Web Services. (n.d.). Retrieved May 28, 2021.","url":"https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBInstances.html"},{"source_name":"Amazon Describe Instance","description":"Amazon. (n.d.). describe-instance-information. Retrieved March 3, 2020.","url":"https://docs.aws.amazon.com/cli/latest/reference/ssm/describe-instance-information.html"},{"source_name":"Amazon Describe Instances API","description":"Amazon. (n.d.). DescribeInstances. Retrieved May 26, 2020.","url":"https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstances.html"},{"source_name":"Google Compute Instances","description":"Google. (n.d.). gcloud compute instances list. Retrieved May 26, 2020.","url":"https://cloud.google.com/sdk/gcloud/reference/compute/instances/list"},{"source_name":"Mandiant M-Trends 2020","description":"Mandiant. (2020, February). M-Trends 2020. Retrieved November 17, 2024.","url":"https://www.mandiant.com/sites/default/files/2021-09/mtrends-2020.pdf"},{"source_name":"Microsoft AZ CLI","description":"Microsoft. (n.d.). az ad user. Retrieved October 6, 2019.","url":"https://docs.microsoft.com/en-us/cli/azure/ad/user?view=azure-cli-latest"},{"source_name":"Malwarebytes OSINT Leaky Buckets - Hioureas","description":"Vasilios Hioureas. (2019, September 13). Hacking with AWS: incorporating leaky buckets into your OSINT workflow. Retrieved February 14, 2022.","url":"https://blog.malwarebytes.com/researchers-corner/2019/09/hacking-with-aws-incorporating-leaky-buckets-osint-workflow/"}],"platforms":["IaaS"],"environments":["cloud"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0017","name":"Cloud Storage Enumeration","page":"telemetry/DC0017/","kind":"attack_component","category":"Cloud storage","description":"Requests that enumerate storage buckets, containers or objects.","collection_focus":"Log list operations at the applicable API layer and preserve target prefix, caller, pagination and outcome; check event-selector support for the specific API.","providers":[{"name":"AWS CloudTrail for S3","scope":"Bucket control-plane events and explicitly selected object data events.","source_id":"data_events"},{"name":"Google Cloud Audit Logs","scope":"Cloud Storage access requires the relevant audit category and permissions.","source_id":"gcp"},{"name":"Azure storage resource logs","scope":"Use resource-specific data-plane diagnostics; Activity Log alone does not describe blob reads.","source_id":"azure_storage"}],"configuration":["Choose only the lab buckets/containers and prefixes. Enable read/write data-event collection when object access is needed; management events alone are insufficient.","Keep administrative changes separately from object reads/writes. Set a cost budget and retention limit before enabling high-volume data logging.","Preserve object version/key, requesting identity, action, source address, result and request ID. Verify the collector actually receives one benign read and one benign write."],"configuration_example":null,"required_fields":["action","bucket","prefix","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0017","collector":"illustrative-lab-collector","observation":{"action":"list_objects","bucket":"lab-bucket","prefix":"demo/","actor":"lab-reader","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Storage metadata, listing, object access and bucket administration are different operations. Do not equate a successful request with proven exfiltration or complete content visibility.","sources":[{"id":"data_events","title":"AWS CloudTrail data-event selectors","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html"},{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"},{"id":"azure_storage","title":"Azure Blob Storage resource logging","url":"https://learn.microsoft.com/en-us/azure/storage/blobs/monitor-blob-storage"}],"association":"attack_component","anomaly_design":"Per principal and bucket/container: unusual object-read counts, transferred volume, new access pairs and bulk permission/deletion activity. Model backups, migrations and lifecycle policies separately."},{"id":"DC0075","name":"Instance Enumeration","page":"telemetry/DC0075/","kind":"attack_component","category":"Cloud control plane","description":"Listing or discovery requests for cloud compute instances.","collection_focus":"Include supported read management APIs and retain caller, scope, query/filter and result; read auditing differs between providers.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["action","region","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0075","collector":"illustrative-lab-collector","observation":{"action":"list_instances","region":"lab-region","actor":"lab-reader","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."},{"id":"DC0086","name":"Instance Metadata","page":"telemetry/DC0086/","kind":"attack_component","category":"Cloud control plane","description":"Compute-instance properties observed through the control plane.","collection_focus":"Collect authorized instance inventory: resource ID, image, role, interfaces, tags and observation time; avoid confusing inventory with guest execution telemetry.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["instance_id","image_id","role","state"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0086","collector":"illustrative-lab-collector","observation":{"instance_id":"vm-lab-1","image_id":"image-lab-1","role":"lab-reader","state":"running"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."}],"detection":{"key":"enterprise/T1580","id":"T1580","name":"Cloud Infrastructure Discovery","domain":"enterprise","platforms":["IaaS"],"environments":["cloud"],"source_url":"https://attack.mitre.org/techniques/T1580","technique_page":"techniques/enterprise/T1580/","page":"detections/enterprise/T1580/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[{"id":"f305fd62-beca-47da-ad95-7690a0620084","title":"Potential Bucket Enumeration on AWS","status":"test","level":"low","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/f305fd62-beca-47da-ad95-7690a0620084.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_enum_buckets.yml","author":"Christopher Peacock @securepeacock, SCYTHE @scythe_io","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1580-1","technique_id":"T1580","title":"T1580 Cloud Infrastructure Discovery","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#discovery","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":134,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L134","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"9d1ce6a5109deff05b5123774ab568f727b071161a2c7a30451d259dc1fe1c4e","validation":"published_concept_not_executable_or_live_validated","logic":"COUNT(cloud_list_or_describe_operations BY identity, 10m) >= threshold AND identity NOT_IN approved_inventory_roles -> ALERT","log_sources":[{"title":"Cloud Control-Plane Audit Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#103-cloud-control-plane-audit-logs"},{"title":"Cloud Resource-Configuration Inventory","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#114-cloud-resource-configuration-inventory"}]}],"atlas_anomaly":[{"id":"atlas-anomaly-t1580-1","technique_id":"T1580","title":"Cloud resources or configurations enumerated — T1580 Cloud Infrastructure Discovery","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#cloud-enumeration","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":90,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L90","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"8384f57856a3f6fb771a076036ac8c59faded00533338b288f586f7fe32ab09d","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"cloud identity and API action distribution.","expected_behavior":"identities use a role-specific action set.","deviation":"peer-group deviation, high API category diversity, or burst of list and describe operations.","anomaly_types":[{"title":"Peer-Group Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#8-peer-group-anomaly"},{"title":"Categorical-Distribution Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#87-categorical-distribution-anomaly"},{"title":"Burst Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#16-burst-anomaly"}],"log_sources":[{"title":"Cloud Control-Plane Audit Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#103-cloud-control-plane-audit-logs"},{"title":"Cloud Resource-Configuration Inventory","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#114-cloud-resource-configuration-inventory"}],"context_references":[{"title":"Sysdig SCARLETEEL investigation — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/sysdig-scarleteel.html"},{"title":"original source","url":"https://www.sysdig.com/blog/cloud-breach-terraform-data-theft"}]}],"anomaly_types":[{"title":"Burst Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#16-burst-anomaly"},{"title":"Categorical-Distribution Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#87-categorical-distribution-anomaly"},{"title":"Peer-Group Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#8-peer-group-anomaly"}],"strategies":[{"id":"DET0169","name":"Detection Strategy for Cloud Infrastructure Discovery","url":"https://attack.mitre.org/detectionstrategies/DET0169","stix_id":"x-mitre-detection-strategy--22331b2d-e8a1-4820-ae6b-7d04f24f7df7","relationship_id":"relationship--87f3ef36-2cfb-4707-96ea-650c60471651","description":"","analytics":[{"id":"AN0481","name":"Analytic 0481","guidance":"Defenders should monitor for suspicious enumeration of cloud infrastructure components via APIs or CLI tools. Observable behaviors include repeated listing or description operations for compute instances, snapshots, storage buckets, and volumes. From a defender’s perspective, risky activity is often identified by new or untrusted identities making discovery calls (e.g., DescribeInstances, ListBuckets, az vm list, gcloud compute instances list), enumeration from unusual geolocations or IPs, or rapid multi-service discovery in sequence. Correlating discovery API usage with later snapshot creation or instance modification provides further context of adversary behavior.","url":"https://attack.mitre.org/detectionstrategies/DET0169#AN0481","platforms":["IaaS"],"tuning":[{"field":"UserContext","description":"Identity performing the discovery operation; tuned to filter known administrative or inventory accounts."},{"field":"GeoLocation","description":"Source region or IP of discovery requests; tuned to expected operational regions to detect unusual access."},{"field":"TimeWindow","description":"Correlation period to link enumeration calls with subsequent provisioning or exfiltration activity."},{"field":"APIThreshold","description":"Rate or volume of discovery calls; tuned to suppress noise from inventory management tools."}],"log_sources":[{"component_id":"DC0086","component":"Instance Metadata","name":"AWS:CloudTrail","channel":"DescribeInstances","platforms":["IaaS"],"analytic_id":"AN0481","source_url":"https://attack.mitre.org/detectionstrategies/DET0169#AN0481","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0086/"},{"component_id":"DC0017","component":"Cloud Storage Enumeration","name":"AWS:CloudTrail","channel":"ListBuckets","platforms":["IaaS"],"analytic_id":"AN0481","source_url":"https://attack.mitre.org/detectionstrategies/DET0169#AN0481","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0017/"},{"component_id":"DC0075","component":"Instance Enumeration","name":"AWS:CloudTrail","channel":"DescribeDBInstances","platforms":["IaaS"],"analytic_id":"AN0481","source_url":"https://attack.mitre.org/detectionstrategies/DET0169#AN0481","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0075/"}]}]}],"telemetry_references":[{"id":"DC0017","name":"Cloud Storage Enumeration","tag":"Cloud Storage Enumeration","page":"telemetry/DC0017/","kind":"attack_component"},{"id":"DC0075","name":"Instance Enumeration","tag":"Instance Enumeration","page":"telemetry/DC0075/","kind":"attack_component"},{"id":"DC0086","name":"Instance Metadata","tag":"Instance Metadata","page":"telemetry/DC0086/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S1091","name":"Pacu","page":"tools/S1091/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S9009","name":"TruffleHog","page":"tools/S9009/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S1091","name":"Pacu","page":"tools/S1091/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S9009","name":"TruffleHog","page":"tools/S9009/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S1091","name":"Pacu","url":"https://attack.mitre.org/software/S1091","kind":"tool","description":"[Pacu](https://attack.mitre.org/software/S1091) can enumerate AWS infrastructure, such as EC2 instances.(Citation: GitHub Pacu)","relationship_id":"relationship--c4cce9f3-6124-4ead-94b2-789464bd2719","references":[{"source_name":"GitHub Pacu","description":"Rhino Security Labs. (2019, August 22). Pacu. Retrieved October 17, 2019.","url":"https://github.com/RhinoSecurityLabs/pacu"}]},{"id":"S9009","name":"TruffleHog","url":"https://attack.mitre.org/software/S9009","kind":"tool","description":"[TruffleHog](https://attack.mitre.org/software/S9009) can enumerate AWS Infrastructure to include EC2 instances.(Citation: Github TruffleSecurity Trufflehog April 2025)","relationship_id":"relationship--97e1ea2b-f8c8-4195-9bc2-9cad77368dca","references":[{"source_name":"Github TruffleSecurity Trufflehog April 2025","description":"Trufflesecurity. (2026, April 8). TruffleHog Enterprise. Retrieved April 15, 2026.","url":"https://github.com/trufflesecurity/trufflehog"}]},{"id":"S9041","name":"TeamPCP Cloud Stealer","url":"https://attack.mitre.org/software/S9041","kind":"malware","description":"[TeamPCP Cloud Stealer](https://attack.mitre.org/software/S9041) has the ability to search for generic GitHub runners.(Citation: Wiz TeamPCP KICS MAR 2026)","relationship_id":"relationship--0cc93ab3-094a-46f4-921c-486824dcf78f","references":[{"source_name":"Wiz TeamPCP KICS MAR 2026","description":"McCarthy, R., Haughom, J., Read, B. (2026, March 23). KICS GitHub Action Compromised: TeamPCP Strikes Again in Supply Chain Attack. Retrieved July 1, 2026.","url":"https://www.wiz.io/blog/teampcp-attack-kics-github-action"}]}],"actors":[{"id":"G1015","name":"Scattered Spider","url":"https://attack.mitre.org/groups/G1015","kind":"intrusion-set","description":"[Scattered Spider](https://attack.mitre.org/groups/G1015) enumerates cloud environments including Amazon Web Services (AWS) S3 buckets to identify server and backup management infrastructure, resource access, databases and storage containers .(Citation: MSTIC Octo Tempest Operations October 2023)(Citation: Mandiant UNC3944 May 2025)(Citation: CrowdStrike Scattered Spider JUL 2025)","relationship_id":"relationship--105550a6-3e85-4286-a4de-f7d0d68380ed","references":[{"source_name":"CrowdStrike Scattered Spider JUL 2025","description":" Counter Adversary Operations. (2025, July 2). CrowdStrike Services Observes SCATTERED SPIDER Escalate Attacks Across Industries. Retrieved October 13, 2025.","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-services-observes-scattered-spider-escalate-attacks/"},{"source_name":"Mandiant UNC3944 May 2025","description":"Mandiant Incident Response. (2025, May 6). Defending Against UNC3944: Cybercrime Hardening Guidance from the Frontlines. Retrieved October 13, 2025.","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations"},{"source_name":"MSTIC Octo Tempest Operations October 2023","description":"Microsoft. (2023, October 25). Octo Tempest crosses boundaries to facilitate extortion, encryption, and destruction. Retrieved March 18, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/"}]},{"id":"G1053","name":"Storm-0501","url":"https://attack.mitre.org/groups/G1053","kind":"intrusion-set","description":"[Storm-0501](https://attack.mitre.org/groups/G1053) has enumerated compromised cloud environments to identify critical assets, data stores, and back resources.(Citation: Microsoft Storm-0501 Embargo Ransomware August 2025)","relationship_id":"relationship--b2e1d4a6-9282-48b8-a049-550255a13106","references":[{"source_name":"Microsoft Storm-0501 Embargo Ransomware August 2025","description":"Microsoft Threat Intelligence. (2025, August 27). Storm-0501’s evolving techniques lead to cloud-based ransomware. Retrieved October 19, 2025.","url":"https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"}]},{"id":"G1057","name":"ShinyHunters","url":"https://attack.mitre.org/groups/G1057","kind":"intrusion-set","description":"[ShinyHunters](https://attack.mitre.org/groups/G1057) has used Amazon Simple Storage Service (S3) Browser and WinSCP to collect information on S3 bucket configurations.(Citation: Unit42KelleyVaya_BlingLibra_Aug2024)(Citation: SOCRadar_ShinyHunters_Mar2024)  ","relationship_id":"relationship--b04004a8-57bd-4245-813b-9e64ede24a18","references":[{"source_name":"Unit42KelleyVaya_BlingLibra_Aug2024","description":"Kelley, M., Vaya, C. (2024, August 23). Bling Libra’s Tactical Evolution: The Threat Actor Group Behind ShinyHunters Ransomware. Retrieved May 18, 2026.","url":"https://unit42.paloaltonetworks.com/shinyhunters-ransomware-extortion/"},{"source_name":"SOCRadar_ShinyHunters_Mar2024","description":"SOCRadar. (2024, March 18). Dark Web Profile: ShinyHunters. Retrieved May 18, 2026.","url":"https://socradar.io/dark-web-profile-shinyhunters/"}]}],"mitigations":[{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Limit permissions to discover cloud infrastructure in accordance with least privilege. Organizations should limit the number of users within the organization with an IAM role that has administrative privileges, strive to reduce all permanent privileged role assignments, and conduct periodic entitlement reviews on IAM users, roles and policies.","relationship_id":"relationship--00c4456d-cea9-43bf-913b-ec566699ce61","references":[]}],"candidates":[{"id":"99b38f24-5acc-4aa3-85e5-b7f97a5d37ac","name":"AWS - EC2 Security Group Enumeration","platforms":["iaas:aws"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":2,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1580/T1580.yaml","description":"Simulate an attacker's action to enumerate EC2 Security Groups in a compromised AWS environment.","inputs":{"aws_profile":{"description":"AWS CLI profile name","type":"string","default":"default"},"output_format":{"description":"Desired output format (text, table, json)","type":"string","default":"json"}},"dependencies":[{"description":"AWS CLI installed and configured with the necessary access rights."},{"description":"Check if AWS CLI is installed and configured."}],"source_definition_sha256":"06df886f95aa384b1680f6f2847b9596f5b40c6e22324b51fd9267fe39c5bc41"},{"id":"99ee161b-dcb1-4276-8ecb-7cfdcb207820","name":"AWS - EC2 Enumeration from Cloud Instance","platforms":["linux","macos","iaas:aws"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":2,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1580/T1580.yaml","description":"This atomic runs several API calls (sts:GetCallerIdentity, s3:ListBuckets, iam:GetAccountSummary, iam:ListRoles, iam:ListUsers, iam:GetAccountAuthorizationDetails, ec2:DescribeSnapshots, cloudtrail:DescribeTrails, guardduty:ListDetectors) from the context of an EC2 instance role. This simulates an attacker compromising an EC2 instance and running initial discovery commands on it. This atomic test leverages a tool called stratus-red-team built by DataDog (https://github.com/DataDog/stratus-red-team). Stratus Red Team is a self-contained binary. You can use it to easily detonate offensive attack techniques against a live cloud environment. Ref: https://stratus-red-team.cloud/attack-techniques/AWS/aws.discovery.ec2-enumerate-from-instance/\n","inputs":{"stratus_path":{"description":"Path of stratus binary","type":"path","default":"$PathToAtomicsFolder/T1580/src"},"aws_region":{"description":"AWS region to detonate","type":"string","default":"us-west-2"}},"dependencies":[{"description":"Stratus binary must be present at the (#{stratus_path}/stratus)\n"},{"description":"Check if ~/.aws/credentials file has a default stanza is configured\n"}],"source_definition_sha256":"9bb71c90c307b4196f6f5b02b5e4c3deff98823adca10c1c4eed93cb1cc302d6"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1595.003":"/ttp-simulation/techniques/enterprise/T1595.003/","T1526":"/ttp-simulation/techniques/enterprise/T1526/","T1580":"/ttp-simulation/techniques/enterprise/T1580/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1580","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0017","collector":"illustrative-lab-collector","observation":{"action":"list_objects","bucket":"lab-bucket","prefix":"demo/","actor":"lab-reader","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0075","collector":"illustrative-lab-collector","observation":{"action":"list_instances","region":"lab-region","actor":"lab-reader","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0086","collector":"illustrative-lab-collector","observation":{"instance_id":"vm-lab-1","image_id":"image-lab-1","role":"lab-reader","state":"running"}}]}}