Cloud Infrastructure Discovery T1580
Tactic: Discovery
An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-service (IaaS) environment. This includes compute service resources such as instances, virtual machines, and snapshots as well as resources of other services including the storage and database services.
Events covered
1 catalog event is tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 3 | Network connection |
Authoring guide
These 44 rules share fields, values, and exclusions.
Fields filtered most (68 distinct)
These fields appear most often in rule filters.
Top indicator values (373 distinct)
These values appear most often in rule predicates.
Exclusions (26 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 2 rules
Elastic 23 rules
- AWS Account Discovery By Rare User
- AWS Discovery API Calls from VPN ASN for the First Time by Identity
- AWS Discovery API Calls via CLI from a Single Resource
- AWS EC2 Deprecated AMI Discovery
- AWS EC2 Multi-Region DescribeInstances API Calls
- AWS EC2 User Data Retrieval for EC2 Instance
- AWS S3 Bucket Enumeration or Brute Force
- AWS S3 Rapid Bucket Posture API Calls from a Single Principal
- AWS Service Quotas Multi-Region GetServiceQuota Requests
- AWS SSM Inventory Reconnaissance by Rare User
- Azure Storage Anonymous Blob Access to Unusual Resource
- Azure WireServer Unusual Process Connection
- Entra ID Sign-in BloodHound Suite User-Agent Detected
- Entra ID Sign-in TeamFiltration User-Agent Detected
- Rare AWS Error Code
- Rare Azure Activity Logs Event Failures
- Rare GCP Audit Failure Event Code
- Spike in AWS Error Messages
- Spike in Azure Activity Logs Failed Messages
- Spike in GCP Audit Failed Messages
- Suspicious Instance Metadata Service (IMDS) API Command Line Execution
- Suspicious Instance Metadata Service (IMDS) API Request
- Unusual Windows Process Calling the Metadata Service
Splunk 5 rules
- ASL AWS IAM AccessDenied Discovery Events
- ASL AWS IAM Assume Role Policy Brute Force
- AWS Bedrock High Number List Foundation Model Failures
- AWS IAM AccessDenied Discovery Events
- AWS IAM Assume Role Policy Brute Force
Kusto 7 rules
- API - Kiterunner detection
- AWSCloudTrail - Monitor AWS Credential abuse or hijacking
- AWSCloudTrail - User IAM Enumeration
- Dataverse - Suspicious use of Web API
- Dataverse - TI map IP to DataverseActivity
- OCI - Discovery activity
- Unauthorized user access across AWS and Azure
YARA-L 4 rules
- AWS EC2 High Number Of API Calls
- AWS Excessive Successful Discovery Events
- AWS IAM Access Denied Discovery Events
- GCP Excessive Permission Denied Events