Techniques › T1526
T1526 Cloud Service Discovery
discovery — IaaS, Identity Provider, Office Suite, SaaS · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
3
Sigma rules tagged attack.t1526
0
KEV CVEs mapped here
<p>An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Entra ID, etc. They may also include security services, such as AWS GuardDuty and Microsoft Defender for Cloud, and logging services, such as AWS CloudTrail and Google Cloud Audit Logs.</p><p>Adversaries may attempt to discover information about the services enabled throughout the environment. Azure tools and APIs, such as the Microsoft Graph API and Azure Resource Manager API, can enumerate resources and services, including applications, management groups, resources and policy definitions, and their relationships that are accessible by an identity.</p><p>For example, Stormspotter is an open source tool for enumerating and constructing a graph for Azure resources and services, and Pacu is an open source AWS exploitation framework that supports several methods for discovering cloud services.</p><p>Adversaries may use the information gained to shape follow-on behaviors, such as targeting data or credentials from enumerated services or evading identified defenses through Disable or Modify Tools or Disable or Modify Cloud Log.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0402 Detection Strategy for Cloud Service Discovery v1.0
AN1127 IaaSUnusual enumeration of services and resources through cloud APIs such as AWS CLI
describe-*, Azure Resource Manager queries, or GCP project listings. Defender perspective includes anomalous API calls, unexpected volume of service enumeration, and correlation of discovery with recently compromised sessions.AWS:CloudTrailDescribeInstances, DescribeServices, ListFunctions: High frequency enumeration calls or unusual user agents performing discovery→ DC0083 Cloud Service EnumerationAWS:CloudTrailAssumeRole: Discovery actions tied to assumed identities outside of normal context→ DC0013 User Account MetadataTunable:EnumerationRateThresholdUserAgentFilterAN1128 Identity ProviderEnumeration of directories, applications, or service principals through APIs such as Microsoft Graph or Okta API. Defender perspective includes unexpected listing of users, roles, applications, and abnormal access to identity management endpoints.azure:auditListApplications, ListServicePrincipals: Large-scale queries against identity or application objects→ DC0083 Cloud Service Enumerationazure:signinlogsInteractiveUserLogin: Discovery behavior linked to privileged logins from atypical IP ranges→ DC0067 Logon Session CreationTunable:QueryVolumeThresholdPrivilegedRoleListAN1129 Office SuiteDiscovery of SaaS services connected to productivity platforms (e.g., Microsoft 365, Google Workspace). Defender perspective includes unexpected enumeration of enabled services, API integrations, or OAuth applications tied to user accounts.m365:unifiedGet-MsolServicePrincipal, ListAppRoles: Service discovery operations executed by accounts not normally performing administrative tasks→ DC0083 Cloud Service Enumerationm365:signinlogsUserLogin: Discovery operations shortly after account logins from new geolocations→ DC0067 Logon Session CreationTunable:MonitoredAppIntegrationsGeoLocationDeviationAN1130 SaaSDiscovery of connected SaaS applications, APIs, or configurations within platforms like Salesforce, Slack, or Zoom. Defender perspective includes enumeration of available integrations, abnormal querying of service metadata, and follow-on attempts to exploit or persist via discovered services.saas:adminapiListIntegrations, ListServices: Repeated service discovery requests from accounts without administrative responsibilities→ DC0083 Cloud Service Enumerationsaas:authLogin, TokenGranted: Discovery actions tied to anomalous login sessions or tokens→ DC0067 Logon Session CreationTunable:IntegrationDiscoveryThresholdServiceAccountScope
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1526
Author: Janantha Marasinghe
· 2022-11-27 · logsource: product=azure service=signinlogs · 35b781cc-1a08-4a5a-80af-42fd7c315c6b
Detects AzureHound (A BloodHound data collector for Microsoft Azure) activity via the default User-Agent that is used during its operation after successful authentication.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-10-18 (modified 2023-02-04) · logsource: product=windows category=process_creation · 38646daa-e78f-4ace-9de0-55547b2d30da
Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters
Author: Muhammad Faisal (@faisalusuf)
· 2023-01-27 · logsource: product=github service=audit · f8ed0e8f-7438-4b79-85eb-f358ef2fbebd
A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com.
This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected,
it should be validated from GitHub UI because the log entry may not provide full context.