T1526 Cloud Service Discovery — Attack Simulation

An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Entra ID, etc. They may also include security services, such as AWS…

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

Azure - Dump Subscription Data with MicroBurst
iaas:azure automated powershell
Procedure 1e40bb1d-195e-401e-a86b-c192f55e005c; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Azure - Enumerate common cloud services
iaas:azure automated powershell
Procedure 58f57c8f-db14-4e62-a4d3-5aaf556755d7; elevation not declared required; cleanup not declared. Not executed or individually validated.
AWS - Enumerate common cloud services
iaas:aws automated powershell
Procedure aa8b9bcc-46fa-4a59-9237-73c7b93a980c; elevation not declared required; cleanup not declared. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise cloud identity onprem saas IaaS Identity Provider Office Suite SaaS discovery isolated_authorized_lab procedure_review_required telemetry_configuration_required disposable_tenant_and_cost_controls

can_simulate technique source_mapped

Detection and collection

T1526 detection workspace

Attack tools

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Storm-0501 · G1053

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.