Complete technique description
An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Entra ID, etc. They may also include security services, such as AWS GuardDuty and Microsoft Defender for Cloud, and logging services, such as AWS CloudTrail and Google Cloud Audit Logs.
Adversaries may attempt to discover information about the services enabled throughout the environment. Azure tools and APIs, such as the Microsoft Graph API and Azure Resource Manager API, can enumerate resources and services, including applications, management groups, resources and policy definitions, and their relationships that are accessible by an identity.[Azure - Resource Manager API][Azure AD Graph API]
For example, Stormspotter is an open source tool for enumerating and constructing a graph for Azure resources and services, and Pacu is an open source AWS exploitation framework that supports several methods for discovering cloud services.[Azure - Stormspotter][GitHub Pacu]
Adversaries may use the information gained to shape follow-on behaviors, such as targeting data or credentials from enumerated services or evading identified defenses through Disable or Modify Tools or Disable or Modify Cloud Log.
Official technique definition · Open in the interactive matrix
Detection telemetry and configuration
These contracts are selected through exact technique-to-data-component relationships or explicitly labelled planning overrides. Configure a collector at the relevant observation point; a telemetry name alone is not coverage.
Cloud Service Enumeration · source-mapped
DC0083 collection page — Collect supported list/describe administrative APIs and retain caller and queried service scope; confirm read-event retention.
Providers and collection configuration
- In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.
- Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.
- Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies.
Required normalized fields: actor, service, action, result.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0083",
"collector": "illustrative-lab-collector",
"observation": {
"actor": "lab-reader",
"service": "lab-monitoring",
"action": "list_resources",
"result": "success"
}
}
Visibility limits: AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.
Logon Session Creation · source-mapped
DC0067 collection page — Enable Audit Logon and collect successful session creation on the receiving host; join session/logon IDs rather than only account names.
Providers and collection configuration
- Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.
- For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.
- Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*.
Required normalized fields: account, logon_id, logon_type, source_ip.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0067",
"collector": "illustrative-lab-collector",
"observation": {
"account": "LAB\\analyst",
"logon_id": "0x12345",
"logon_type": 3,
"source_ip": "192.0.2.10"
}
}
Visibility limits: A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.
User Account Metadata · source-mapped
DC0013 collection page — Export an authorized directory/account inventory with stable IDs, roles, enabled state and collection time; compare snapshots without exposing credentials.
Providers and collection configuration
- osquery: Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.
- Linux Audit plus inventory snapshots: Events explain changes; snapshots describe state at collection time.
- Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.
- Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.
- Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset.
Required normalized fields: account_id, enabled, roles, inventory_time.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0013",
"collector": "illustrative-lab-collector",
"observation": {
"account_id": "user-lab-1",
"enabled": true,
"roles": [
"lab-reader"
],
"inventory_time": "2026-09-27T12:00:00Z"
}
}
Visibility limits: Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.
Simulation design and documented procedures
Atomic evidence: 3 compatible documented candidates. Live lab status: not run for these imported procedures.
Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.
Azure - Dump Subscription Data with MicroBurst
Upon successful execution, this test will enumerate all resources that are contained within a valid Azure subscription.
The resources enumerated will display on screen, as well as several csv files and folders will be output to a specified directory, listing what resources were discovered by the script.
See https://dev.to/cheahengsoon/enumerating-subscription-information-with-microburst-35a1
Pinned Atomic procedure · 1e40bb1d-195e-401e-a86b-c192f55e005c · iaas:azure · powershell.
Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
username: Azure AD username (type string; source default password: Azure AD password (type string; source default T1082Az)output_directory: Directory to output results to (type string; source default $env:temp\T1526Test1)subscription_name: Azure subscription name to scan (type string; source default
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
2 prerequisite definitions:
- The Get-AzDomainInfo script must exist in PathToAtomicsFolder\..\ExternalPayloads.
- The Az module must be installed.
Azure - Enumerate common cloud services
Upon successful execution, this test will enumerate common resources that are contained within a valid Azure subscription.
Pinned Atomic procedure · 58f57c8f-db14-4e62-a4d3-5aaf556755d7 · iaas:azure · powershell.
Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.
client_id: Azure AD client ID (type string; source default client_secret: Azure AD client secret (type string; source default tenant_id: Azure AD tenant ID (type string; source default cloud: Azure cloud environment (type string; source default AzureCloud)output_directory: Directory to output results to (type string; source default $env:TMPDIR/azure_discovery)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
1 prerequisite definitions:
- The Az module must be installed.
AWS - Enumerate common cloud services
Upon successful execution, this test will enumerate common resources that are contained within a valid AWS account.
Pinned Atomic procedure · aa8b9bcc-46fa-4a59-9237-73c7b93a980c · iaas:aws · powershell.
Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.
access_key: AWS Access Key (type string; source default secret_key: AWS Secret Key (type string; source default session_token: AWS Session Token (type string; source default profile: AWS profile (type string; source default regions: AWS regions (type string; source default us-east-1,us-east-2,us-west-1,us-west-2)output_directory: Directory to output results to (type string; source default $env:TMPDIR/aws_discovery)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
1 prerequisite definitions:
- The AWS PowerShell module must be installed.
Technique-specific experiment contract
- Choose one procedure implementing T1526 Cloud Service Discovery; identify the observable behavior in the source definition, not just its tactic.
- Record exact target, tool/version, inputs, privileges, network limits and approval. Never run an imported default target automatically.
- Enable the collection sources above and verify a benign baseline reaches the detector.
- Run only the approved isolated scenario; capture native events and an independent behavior observable.
- Evaluate the exact rule/model, restore the lab, and preserve configuration, event hashes, alerts, controls and misses.