Cloud Storage Object Discovery (T1619)

Tactic: Discovery · Platforms: IaaS

The interactive view maps 1 detection strategy, 1 mitigation, 3 software entries to this technique, alongside D3FEND countermeasures and data-component coverage.

Overview

Adversaries may enumerate objects in cloud storage infrastructure. Adversaries may use this information during automated discovery to shape follow-on behaviors, including requesting all or specific objects from cloud storage. Similar to File and Directory Discovery on a local host, after identifying available storage services (i.e. Cloud Infrastructure Discovery) adversaries may access the contents/objects stored in cloud infrastructure.

Cloud service providers offer APIs allowing users to enumerate objects stored within cloud storage. Examples include ListObjectsV2 in AWS and List Blobs in Azure .

Explore

• Open T1619 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1619
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan