{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1619","id":"T1619","name":"Cloud Storage Object Discovery","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1619","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"a063ec5427aa182642ac31d6e2db0ae9ae03d2f6d6c8f5d62c3a8fdf98a9eb20","description":"Adversaries may enumerate objects in cloud storage infrastructure. Adversaries may use this information during automated discovery to shape follow-on behaviors, including requesting all or specific objects from cloud storage.  Similar to [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) on a local host, after identifying available storage services (i.e. [Cloud Infrastructure Discovery](https://attack.mitre.org/techniques/T1580)) adversaries may access the contents/objects stored in cloud infrastructure.\n\nCloud service providers offer APIs allowing users to enumerate objects stored within cloud storage. Examples include ListObjectsV2 in AWS (Citation: ListObjectsV2) and List Blobs in Azure(Citation: List Blobs) .","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1619","external_id":"T1619"},{"source_name":"ListObjectsV2","description":"Amazon - ListObjectsV2. Retrieved October 4, 2021.","url":"https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectsV2.html"},{"source_name":"List Blobs","description":"Microsoft - List Blobs. (n.d.). Retrieved October 4, 2021.","url":"https://docs.microsoft.com/en-us/rest/api/storageservices/list-blobs"}],"platforms":["IaaS"],"environments":["cloud"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0025","name":"Cloud Storage Access","page":"telemetry/DC0025/","kind":"attack_component","category":"Cloud storage","description":"Access to stored cloud data, including reads and provider-supported access outcomes.","collection_focus":"Explicitly select relevant object-read data events; keep principal, key, request ID and result without object contents.","providers":[{"name":"AWS CloudTrail for S3","scope":"Bucket control-plane events and explicitly selected object data events.","source_id":"data_events"},{"name":"Google Cloud Audit Logs","scope":"Cloud Storage access requires the relevant audit category and permissions.","source_id":"gcp"},{"name":"Azure storage resource logs","scope":"Use resource-specific data-plane diagnostics; Activity Log alone does not describe blob reads.","source_id":"azure_storage"}],"configuration":["Choose only the lab buckets/containers and prefixes. Enable read/write data-event collection when object access is needed; management events alone are insufficient.","Keep administrative changes separately from object reads/writes. Set a cost budget and retention limit before enabling high-volume data logging.","Preserve object version/key, requesting identity, action, source address, result and request ID. Verify the collector actually receives one benign read and one benign write."],"configuration_example":{"label":"CloudTrail advanced event selector · example S3 prefix","language":"json","source_id":"data_events","content":"[\n  {\n    \"Name\": \"LabObjectReads\",\n    \"FieldSelectors\": [\n      {\n        \"Field\": \"eventCategory\",\n        \"Equals\": [\n          \"Data\"\n        ]\n      },\n      {\n        \"Field\": \"resources.type\",\n        \"Equals\": [\n          \"AWS::S3::Object\"\n        ]\n      },\n      {\n        \"Field\": \"resources.ARN\",\n        \"StartsWith\": [\n          \"arn:aws:s3:::lab-bucket/demo/\"\n        ]\n      },\n      {\n        \"Field\": \"readOnly\",\n        \"Equals\": [\n          \"true\"\n        ]\n      }\n    ]\n  }\n]","note":"Replace the placeholder with an owned lab bucket/prefix. Review costs and merge with required selectors; applying selectors can replace an existing selection. This does not enable management-event retention or object-write coverage."},"required_fields":["action","bucket","key","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0025","collector":"illustrative-lab-collector","observation":{"action":"get_object","bucket":"lab-bucket","key":"demo.txt","actor":"lab-reader","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Storage metadata, listing, object access and bucket administration are different operations. Do not equate a successful request with proven exfiltration or complete content visibility.","sources":[{"id":"data_events","title":"AWS CloudTrail data-event selectors","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html"},{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"},{"id":"azure_storage","title":"Azure Blob Storage resource logging","url":"https://learn.microsoft.com/en-us/azure/storage/blobs/monitor-blob-storage"}],"association":"attack_component","anomaly_design":"Per principal and bucket/container: unusual object-read counts, transferred volume, new access pairs and bulk permission/deletion activity. Model backups, migrations and lifecycle policies separately."},{"id":"DC0017","name":"Cloud Storage Enumeration","page":"telemetry/DC0017/","kind":"attack_component","category":"Cloud storage","description":"Requests that enumerate storage buckets, containers or objects.","collection_focus":"Log list operations at the applicable API layer and preserve target prefix, caller, pagination and outcome; check event-selector support for the specific API.","providers":[{"name":"AWS CloudTrail for S3","scope":"Bucket control-plane events and explicitly selected object data events.","source_id":"data_events"},{"name":"Google Cloud Audit Logs","scope":"Cloud Storage access requires the relevant audit category and permissions.","source_id":"gcp"},{"name":"Azure storage resource logs","scope":"Use resource-specific data-plane diagnostics; Activity Log alone does not describe blob reads.","source_id":"azure_storage"}],"configuration":["Choose only the lab buckets/containers and prefixes. Enable read/write data-event collection when object access is needed; management events alone are insufficient.","Keep administrative changes separately from object reads/writes. Set a cost budget and retention limit before enabling high-volume data logging.","Preserve object version/key, requesting identity, action, source address, result and request ID. Verify the collector actually receives one benign read and one benign write."],"configuration_example":null,"required_fields":["action","bucket","prefix","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0017","collector":"illustrative-lab-collector","observation":{"action":"list_objects","bucket":"lab-bucket","prefix":"demo/","actor":"lab-reader","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Storage metadata, listing, object access and bucket administration are different operations. Do not equate a successful request with proven exfiltration or complete content visibility.","sources":[{"id":"data_events","title":"AWS CloudTrail data-event selectors","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html"},{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"},{"id":"azure_storage","title":"Azure Blob Storage resource logging","url":"https://learn.microsoft.com/en-us/azure/storage/blobs/monitor-blob-storage"}],"association":"attack_component","anomaly_design":"Per principal and bucket/container: unusual object-read counts, transferred volume, new access pairs and bulk permission/deletion activity. Model backups, migrations and lifecycle policies separately."}],"detection":{"key":"enterprise/T1619","id":"T1619","name":"Cloud Storage Object Discovery","domain":"enterprise","platforms":["IaaS"],"environments":["cloud"],"source_url":"https://attack.mitre.org/techniques/T1619","technique_page":"techniques/enterprise/T1619/","page":"detections/enterprise/T1619/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[{"id":"f305fd62-beca-47da-ad95-7690a0620084","title":"Potential Bucket Enumeration on AWS","status":"test","level":"low","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/f305fd62-beca-47da-ad95-7690a0620084.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_enum_buckets.yml","author":"Christopher Peacock @securepeacock, SCYTHE @scythe_io","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0578","name":"Detection Strategy for Cloud Storage Object Discovery","url":"https://attack.mitre.org/detectionstrategies/DET0578","stix_id":"x-mitre-detection-strategy--c4f5335d-8e85-4b45-86b1-1d5a8cc6523d","relationship_id":"relationship--283829b4-a0ef-4dd8-b9d3-d35d2017b96e","description":"","analytics":[{"id":"AN1594","name":"Analytic 1594","guidance":"Detection of suspicious enumeration of cloud storage objects via API calls such as AWS S3 ListObjectsV2, Azure List Blobs, or GCP ListObjects. Correlate access with account role, user context, and prior authentication activity to identify anomalous usage patterns (e.g., unusual account, unexpected regions, or large-scale enumeration in short time windows).","url":"https://attack.mitre.org/detectionstrategies/DET0578#AN1594","platforms":["IaaS"],"tuning":[{"field":"TimeWindow","description":"Correlation window (e.g., multiple enumeration calls within 5 minutes) may indicate automated discovery versus normal user activity."},{"field":"UserContext","description":"Expected service accounts and IAM roles that regularly enumerate storage; deviations may indicate suspicious activity."},{"field":"RegionScope","description":"Unusual enumeration of buckets across multiple geographic regions in short succession may indicate adversary reconnaissance."}],"log_sources":[{"component_id":"DC0017","component":"Cloud Storage Enumeration","name":"AWS:CloudTrail","channel":"ListObjectsV2","platforms":["IaaS"],"analytic_id":"AN1594","source_url":"https://attack.mitre.org/detectionstrategies/DET0578#AN1594","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0017/"},{"component_id":"DC0025","component":"Cloud Storage Access","name":"AWS:CloudTrail","channel":"GetObject, CopyObject","platforms":["IaaS"],"analytic_id":"AN1594","source_url":"https://attack.mitre.org/detectionstrategies/DET0578#AN1594","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0025/"}]}]}],"telemetry_references":[{"id":"DC0025","name":"Cloud Storage Access","tag":"Cloud Storage Access","page":"telemetry/DC0025/","kind":"attack_component"},{"id":"DC0017","name":"Cloud Storage Enumeration","tag":"Cloud Storage Enumeration","page":"telemetry/DC0017/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S1091","name":"Pacu","page":"tools/S1091/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0683","name":"Peirates","page":"tools/S0683/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S9009","name":"TruffleHog","page":"tools/S9009/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S1091","name":"Pacu","page":"tools/S1091/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0683","name":"Peirates","page":"tools/S0683/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S9009","name":"TruffleHog","page":"tools/S9009/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0683","name":"Peirates","url":"https://attack.mitre.org/software/S0683","kind":"tool","description":"[Peirates](https://attack.mitre.org/software/S0683) can list AWS S3 buckets.(Citation: Peirates GitHub)","relationship_id":"relationship--9f2ee173-a4b2-45d9-8dfe-537f1fc82ef4","references":[{"source_name":"Peirates GitHub","description":"InGuardians. (2022, January 5). Peirates GitHub. Retrieved February 8, 2022.","url":"https://github.com/inguardians/peirates"}]},{"id":"S1091","name":"Pacu","url":"https://attack.mitre.org/software/S1091","kind":"tool","description":"[Pacu](https://attack.mitre.org/software/S1091) can enumerate AWS storage services, such as S3 buckets and Elastic Block Store volumes.(Citation: GitHub Pacu)","relationship_id":"relationship--64d9fee3-d0c8-40e5-b295-d43ec719bb81","references":[{"source_name":"GitHub Pacu","description":"Rhino Security Labs. (2019, August 22). Pacu. Retrieved October 17, 2019.","url":"https://github.com/RhinoSecurityLabs/pacu"}]},{"id":"S9009","name":"TruffleHog","url":"https://attack.mitre.org/software/S9009","kind":"tool","description":"[TruffleHog](https://attack.mitre.org/software/S9009) can enumerate cloud storage environments including Amazon Web Service (AWS) S3 buckets and Google Cloud Storage buckets.(Citation: Black Hills Information Security TruffleHog January 2024)(Citation: Github TruffleSecurity Trufflehog April 2025)","relationship_id":"relationship--2286eded-7606-46df-a469-c5240f21ed75","references":[{"source_name":"Black Hills Information Security TruffleHog January 2024","description":"Chris Traynor. (2024, January 18). Rooting For Secrets with TruffleHog. Retrieved April 15, 2026.","url":"https://www.blackhillsinfosec.com/rooting-for-secrets-with-trufflehog/"},{"source_name":"Github TruffleSecurity Trufflehog April 2025","description":"Trufflesecurity. (2026, April 8). TruffleHog Enterprise. Retrieved April 15, 2026.","url":"https://github.com/trufflesecurity/trufflehog"}]}],"actors":[{"id":"G1057","name":"ShinyHunters","url":"https://attack.mitre.org/groups/G1057","kind":"intrusion-set","description":"[ShinyHunters](https://attack.mitre.org/groups/G1057) has used Amazon Simple Storage Service (S3) Browser and WinSCP to access S3 objects.(Citation: Unit42KelleyVaya_BlingLibra_Aug2024)  ","relationship_id":"relationship--f3a9dfb6-a028-4f80-8823-32b43c9a3fc2","references":[{"source_name":"Unit42KelleyVaya_BlingLibra_Aug2024","description":"Kelley, M., Vaya, C. (2024, August 23). Bling Libra’s Tactical Evolution: The Threat Actor Group Behind ShinyHunters Ransomware. Retrieved May 18, 2026.","url":"https://unit42.paloaltonetworks.com/shinyhunters-ransomware-extortion/"}]}],"mitigations":[{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Restrict granting of permissions related to listing objects in cloud storage to necessary accounts.","relationship_id":"relationship--1a5f8d73-a9c4-40db-9cd5-7f8a7aea19d7","references":[]}],"candidates":[{"id":"070322a4-2c60-4c50-8ffb-c450a34fe7bf","name":"Azure - Enumerate Storage Account Objects via Shared Key authorization using Azure CLI","platforms":["iaas:azure"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1619/T1619.yaml","description":"This test enumerates all existing storage accounts and tries to fetch for each account the contained storage account objects. The access to storage objects is only possible if Shared Key authorization is enabled (e.g this is the case per default for storage objects creaded by Azure Function Apps).\n\nRequirements:\n- The test is intended to be executed in interactive mode (with -Interactive parameter) in order to complete the az login command when MFA is required.\n- The EntraID user must have the role \"Storage Account Contributor\", or a role with similar permissions.\n\nOutput format: Csv file that contains the found storage account objects\n- Columns: ResourceGroup, StorageAccountName, FileShareName, ContainerName, BlobName, TableName, QueueName\n- The content of these columns is filled out depending on the object. Not-required columns are left empt. Example: For a blob object the ResourceGroup, StorageAccountName, ContainerName, BlobName are filled out, the other fields are left empty.","inputs":{"output_file":{"type":"path","default":"$env:temp\\T1619_storage_account_objects.csv","description":"Csv file path for results"}},"dependencies":[{"description":"Azure CLI must be installed"}],"source_definition_sha256":"4f1270478fe500075c69241a3f5bf9db41df11d0f8e50be260a0fb3b677154aa"},{"id":"146af1f1-b74e-4aa7-9895-505eb559b4b0","name":"Azure - Scan for Anonymous Access to Azure Storage (Powershell)","platforms":["iaas:azure"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1619/T1619.yaml","description":"Upon successful execution, this test will test for anonymous access to Azure storage containers by invoking a web request and outputting the results to a file. \nThe corresponding response could then be interpreted to determine whether or not the resource/container exists, as well as other information. \nSee https://ninocrudele.com/the-three-most-effective-and-dangerous-cyberattacks-to-azure-and-countermeasures-part-2-attack-the-azure-storage-service     \n","inputs":{"base_name":{"description":"Azure storage account name to test","type":"string","default":"T1619Test2"},"output_file":{"description":"File to output results to","type":"string","default":"$env:temp\\T1619Test2.txt"},"container_name":{"description":"Container name to search for (optional)","type":"string","default":null},"blob_name":{"description":"Blob name to search for (optional)","type":"string","default":null}},"dependencies":[],"source_definition_sha256":"ab7d0140c621b6406b347bb6e5842571bf565f0112c9c62f86956dcec7120099"},{"id":"3c7094f8-71ec-4917-aeb8-a633d7ec4ef5","name":"AWS S3 Enumeration","platforms":["iaas:aws"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1619/T1619.yaml","description":"This test will enumerate all the S3 buckets in the user account and lists all the files in each bucket. \n","inputs":{},"dependencies":[{"description":"Check if ~/.aws/credentials file has a default stanza is configured\n"}],"source_definition_sha256":"3201115dd644745572b46689007b76abd1adaf4eb0680a8172bffd92305a48fe"},{"id":"3dab4bcc-667f-4459-aea7-4162dd2d6590","name":"Azure - Enumerate Azure Blobs with MicroBurst","platforms":["iaas:azure"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":2,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1619/T1619.yaml","description":"Upon successful execution, this test will utilize a wordlist to enumerate the public facing containers and blobs of a specified Azure storage account. \nSee https://www.netspi.com/blog/technical/cloud-penetration-testing/anonymously-enumerating-azure-file-resources/ . \n","inputs":{"base":{"description":"Azure blob keyword to enumerate (Example, storage account name)","type":"string","default":"secure"},"output_file":{"description":"File to output results to","type":"string","default":"$env:temp\\T1619Test1.txt"},"wordlist":{"description":"File path to keywords for search permutations","type":"string","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\permutations.txt"}},"dependencies":[{"description":"The Invoke-EnumerateAzureBlobs module must exist in PathToAtomicsFolder\\..\\ExternalPayloads.\n"},{"description":"The wordlist file for search permutations must exist in PathToAtomicsFolder\\..\\ExternalPayloads.\n"}],"source_definition_sha256":"fe48c490f2fe476fdf2bce94402b7475af52f291805c6d0b629f0f82d1d04ad5"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1083":"/ttp-simulation/techniques/enterprise/T1083/","T1580":"/ttp-simulation/techniques/enterprise/T1580/","T1619":"/ttp-simulation/techniques/enterprise/T1619/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1619","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0025","collector":"illustrative-lab-collector","observation":{"action":"get_object","bucket":"lab-bucket","key":"demo.txt","actor":"lab-reader","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0017","collector":"illustrative-lab-collector","observation":{"action":"list_objects","bucket":"lab-bucket","prefix":"demo/","actor":"lab-reader","result":"success"}}]}}