Suzy Schapperle - Microsoft Azure Red Team; Praetorian; Thanabodi Phrakhun, I-SECURE; Arun Seelagan, CISA
An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Entra ID, etc. They may also include security services, such as AWS GuardDuty and Microsoft Defender for Cloud, and logging services, such as AWS CloudTrail and Google Cloud Audit Logs.
Adversaries may attempt to discover information about the services enabled throughout the environment. Azure tools and APIs, such as the Microsoft Graph API and Azure Resource Manager API, can enumerate resources and services, including applications, management groups, resources and policy definitions, and their relationships that are accessible by an identity.[1][2]
For example, Stormspotter is an open source tool for enumerating and constructing a graph for Azure resources and services, and Pacu is an open source AWS exploitation framework that supports several methods for discovering cloud services.[3][4]
Adversaries may use the information gained to shape follow-on behaviors, such as targeting data or credentials from enumerated services or evading identified defenses through Disable or Modify Tools or Disable or Modify Cloud Log.
45th pctamong all ATT&CK techniques for number of groups
1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Has discovered the victim environment’s protections to include Azure policies, resource locks, and Azure Storage immutability policies.1
created 2025-10-191 reference
All 1 groups for this technique
5 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Cloud Service Discovery detection strategy DET0402
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Cloud Service Discovery
Enterprise
4 platforms
AN1127 · IaaS
Unusual enumeration of services and resources through cloud APIs such as AWS CLI describe-*, Azure Resource Manager queries, or GCP project listings. Defender perspective includes anomalous API calls, unexpected volume of service enumeration, and correlation of discovery with recently compromised sessions.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
DescribeInstances, DescribeServices, ListFunctions: High frequency enumeration calls or unusual user agents performing discovery
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
EnumerationRateThreshold
Rate of API calls used to enumerate services; tuned to reduce noise from automated inventory tools.
UserAgentFilter
Expected user agents for cloud management tools; deviations may indicate adversarial tools.
AN1128 · Identity Provider
Enumeration of directories, applications, or service principals through APIs such as Microsoft Graph or Okta API. Defender perspective includes unexpected listing of users, roles, applications, and abnormal access to identity management endpoints.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
Discovery of SaaS services connected to productivity platforms (e.g., Microsoft 365, Google Workspace). Defender perspective includes unexpected enumeration of enabled services, API integrations, or OAuth applications tied to user accounts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
Get-MsolServicePrincipal, ListAppRoles: Service discovery operations executed by accounts not normally performing administrative tasks
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
MonitoredAppIntegrations
Specific Office Suite applications or plugins that may be enumerated or targeted.
GeoLocationDeviation
Geographic deviation threshold for discovery actions linked to recent logins.
AN1130 · SaaS
Discovery of connected SaaS applications, APIs, or configurations within platforms like Salesforce, Slack, or Zoom. Defender perspective includes enumeration of available integrations, abnormal querying of service metadata, and follow-on attempts to exploit or persist via discovered services.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
ListIntegrations, ListServices: Repeated service discovery requests from accounts without administrative responsibilities
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
IntegrationDiscoveryThreshold
Number of SaaS integrations enumerated before triggering detection.
ServiceAccountScope
Expected permissions for service accounts to distinguish benign from malicious discovery.
Tests3Executorspowershell 3Need elevation0 of 3Have prerequisites3Have cleanup1Platformsiaas:azure, iaas:aws
#
Test
Platform
Executor
Elevation
Prereqs
Cleanup
Ref
01
Azure - Dump Subscription Data with MicroBurst
iaas:azure
powershell
—
2
Yes
Upon successful execution, this test will enumerate all resources that are contained within a valid Azure subscription.
The resources enumerated will display on screen, as well as several csv files and folders will be output to a specified directory, listing what resources were discovered by the script.
See https://dev.to/cheahengsoon/enumerating-subscription-information-with-microburst-35a1
Top 23%of all ATT&CK techniques for number of rules
Showing 1-11 of 11 rules
Drag headers to reorder | Drag edges to resize
Select
Title
Description
Category
Status
Event
OS
Product
MITRE ATT&CK
CVEs
Severity
Author
Created
Updated
ID
Refs
Splunk
The following analytic detects unauthenticated requests to an Amazon EKS Kubernetes cluster, specifically identifying actions by the "system:anonymous" user. (...)
The following analytic identifies excessive security scanning activities in AWS by detecting a high number of Describe, List, or Get API calls from a single user. (...)
This detection identifies the presence of the default AzureHound user-agent string within Microsoft Graph Activity logs and NonInteractive SignIn Logs. (...)
Detects AzureHound (A BloodHound data collector for Microsoft Azure) activity via the default User-Agent that is used during its operation after successful authentication.