T1580 Cloud Infrastructure Discovery — Attack Simulation

An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-service (IaaS) environment. This includes compute service resources such as instances, virtual machines, and snapshots as well as resources of other services including the storage and database services. Cloud providers offer methods such as APIs and commands issued through CLIs to serve information about infrastructure. For example,…

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

AWS - EC2 Security Group Enumeration
iaas:aws automated command_prompt
Procedure 99b38f24-5acc-4aa3-85e5-b7f97a5d37ac; elevation not declared required; cleanup not declared. Not executed or individually validated.
AWS - EC2 Enumeration from Cloud Instance
linux macos iaas:aws automated sh
Procedure 99ee161b-dcb1-4276-8ecb-7cfdcb207820; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise cloud IaaS discovery isolated_authorized_lab procedure_review_required telemetry_configuration_required disposable_tenant_and_cost_controls

can_simulate technique source_mapped

Detection and collection

T1580 detection workspace

Attack tools

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Connected anomaly research

Curated research views reached through an exact source technique, a catalog model, or a reviewed collection reference. These are navigation associations, not claims of detector effectiveness or sensor equivalence.

Peer-Group

Telemetry contracts · Maintained query examples · Validation and blind spots

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.