Complete technique description
An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-service (IaaS) environment. This includes compute service resources such as instances, virtual machines, and snapshots as well as resources of other services including the storage and database services.
Cloud providers offer methods such as APIs and commands issued through CLIs to serve information about infrastructure. For example, AWS provides a <code>DescribeInstances</code> API within the Amazon EC2 API that can return information about one or more instances within an account, the <code>ListBuckets</code> API that returns a list of all buckets owned by the authenticated sender of the request, the <code>HeadBucket</code> API to determine a bucket’s existence along with access permissions of the request sender, or the <code>GetPublicAccessBlock</code> API to retrieve access block configuration for a bucket.[Amazon Describe Instance][Amazon Describe Instances API][AWS Get Public Access Block][AWS Head Bucket] Similarly, GCP's Cloud SDK CLI provides the <code>gcloud compute instances list</code> command to list all Google Compute Engine instances in a project [Google Compute Instances], and Azure's CLI command <code>az vm list</code> lists details of virtual machines.[Microsoft AZ CLI] In addition to API commands, adversaries can utilize open source tools to discover cloud storage infrastructure through Wordlist Scanning.[Malwarebytes OSINT Leaky Buckets - Hioureas]
An adversary may enumerate resources using a compromised user's access keys to determine which are available to that user.[Expel IO Evil in AWS] The discovery of these available resources may help adversaries determine their next steps in the Cloud environment, such as establishing Persistence.[Mandiant M-Trends 2020]An adversary may also use this information to change the configuration to make the bucket publicly accessible, allowing data to be accessed without authentication. Adversaries have also may use infrastructure discovery APIs such as <code>DescribeDBInstances</code> to determine size, owner, permissions, and network ACLs of database resources. [AWS Describe DB Instances] Adversaries can use this information to determine the potential value of databases and discover the requirements to access them. Unlike in Cloud Service Discovery, this technique focuses on the discovery of components of the provided services rather than the services themselves.
Official technique definition · Open in the interactive matrix
Detection telemetry and configuration
These contracts are selected through exact technique-to-data-component relationships or explicitly labelled planning overrides. Configure a collector at the relevant observation point; a telemetry name alone is not coverage.
Cloud Storage Enumeration · source-mapped
DC0017 collection page — Log list operations at the applicable API layer and preserve target prefix, caller, pagination and outcome; check event-selector support for the specific API.
Providers and collection configuration
- Choose only the lab buckets/containers and prefixes. Enable read/write data-event collection when object access is needed; management events alone are insufficient.
- Keep administrative changes separately from object reads/writes. Set a cost budget and retention limit before enabling high-volume data logging.
- Preserve object version/key, requesting identity, action, source address, result and request ID. Verify the collector actually receives one benign read and one benign write.
Required normalized fields: action, bucket, prefix, actor, result.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0017",
"collector": "illustrative-lab-collector",
"observation": {
"action": "list_objects",
"bucket": "lab-bucket",
"prefix": "demo/",
"actor": "lab-reader",
"result": "success"
}
}
Visibility limits: Storage metadata, listing, object access and bucket administration are different operations. Do not equate a successful request with proven exfiltration or complete content visibility.
Instance Enumeration · source-mapped
DC0075 collection page — Include supported read management APIs and retain caller, scope, query/filter and result; read auditing differs between providers.
Providers and collection configuration
- In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.
- Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.
- Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies.
Required normalized fields: action, region, actor, result.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0075",
"collector": "illustrative-lab-collector",
"observation": {
"action": "list_instances",
"region": "lab-region",
"actor": "lab-reader",
"result": "success"
}
}
Visibility limits: AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.
Instance Metadata · source-mapped
DC0086 collection page — Collect authorized instance inventory: resource ID, image, role, interfaces, tags and observation time; avoid confusing inventory with guest execution telemetry.
Providers and collection configuration
- In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.
- Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.
- Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies.
Required normalized fields: instance_id, image_id, role, state.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0086",
"collector": "illustrative-lab-collector",
"observation": {
"instance_id": "vm-lab-1",
"image_id": "image-lab-1",
"role": "lab-reader",
"state": "running"
}
}
Visibility limits: AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.
Simulation design and documented procedures
Atomic evidence: 2 compatible documented candidates. Live lab status: not run for these imported procedures.
Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.
AWS - EC2 Security Group Enumeration
Simulate an attacker's action to enumerate EC2 Security Groups in a compromised AWS environment.
Pinned Atomic procedure · 99b38f24-5acc-4aa3-85e5-b7f97a5d37ac · iaas:aws · command_prompt.
Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.
aws_profile: AWS CLI profile name (type string; source default default)output_format: Desired output format (text, table, json) (type string; source default json)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
2 prerequisite definitions:
- AWS CLI installed and configured with the necessary access rights.
- Check if AWS CLI is installed and configured.
AWS - EC2 Enumeration from Cloud Instance
This atomic runs several API calls (sts:GetCallerIdentity, s3:ListBuckets, iam:GetAccountSummary, iam:ListRoles, iam:ListUsers, iam:GetAccountAuthorizationDetails, ec2:DescribeSnapshots, cloudtrail:DescribeTrails, guardduty:ListDetectors) from the context of an EC2 instance role. This simulates an attacker compromising an EC2 instance and running initial discovery commands on it. This atomic test leverages a tool called stratus-red-team built by DataDog (https://github.com/DataDog/stratus-red-team). Stratus Red Team is a self-contained binary. You can use it to easily detonate offensive attack techniques against a live cloud environment. Ref: https://stratus-red-team.cloud/attack-techniques/AWS/aws.discovery.ec2-enumerate-from-instance/
Pinned Atomic procedure · 99ee161b-dcb1-4276-8ecb-7cfdcb207820 · linux, macos, iaas:aws · sh.
Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
stratus_path: Path of stratus binary (type path; source default $PathToAtomicsFolder/T1580/src)aws_region: AWS region to detonate (type string; source default us-west-2)
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
2 prerequisite definitions:
- Stratus binary must be present at the (#{stratus_path}/stratus)
- Check if ~/.aws/credentials file has a default stanza is configured
Technique-specific experiment contract
- Choose one procedure implementing T1580 Cloud Infrastructure Discovery; identify the observable behavior in the source definition, not just its tactic.
- Record exact target, tool/version, inputs, privileges, network limits and approval. Never run an imported default target automatically.
- Enable the collection sources above and verify a benign baseline reaches the detector.
- Run only the approved isolated scenario; capture native events and an independent behavior observable.
- Evaluate the exact rule/model, restore the lab, and preserve configuration, event hashes, alerts, controls and misses.