tfMITRE ATT&CK technique

Cloud Service Discovery T1526

Tactic: Discovery
Platforms: IaaS, Identity Provider, Office Suite, SaaS
Version: 1.4
Created: 30 August 2019
Last modified: 12 May 2026
Contributors: Suzy Schapperle - Microsoft Azure Red Team; Praetorian; Thanabodi Phrakhun, I-SECURE; Arun Seelagan, CISA

An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Entra ID, etc. They may also include security services, such as AWS GuardDuty and Microsoft Defender for Cloud, and logging services, such as AWS CloudTrail and Google Cloud Audit Logs.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware66th pct

Tools & malware66th percentile · 66% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 23%

Detection rules77th percentile · 77% of ATT&CK techniques have this many detection rules written or fewer.

Cloud Service Discovery MITRE reference T1526

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Storm-0501G1053 ↗

Has discovered the victim environment’s protections to include Azure policies, resource locks, and Azure Storage immutability policies.1

created 2025-10-191 reference

All 1 groups for this technique

Offense vs defense T1526

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 8

first rule: 2020 Q2

Cloud Service Discovery detection strategy DET0402

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Cloud Service Discovery

Enterprise

4 platforms

AN1127 · IaaS

Unusual enumeration of services and resources through cloud APIs such as AWS CLI describe-*, Azure Resource Manager queries, or GCP project listings. Defender perspective includes anomalous API calls, unexpected volume of service enumeration, and correlation of discovery with recently compromised sessions.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account MetadataDC0013	AWS:CloudTrail	AssumeRole: Discovery actions tied to assumed identities outside of normal context
Cloud Service EnumerationDC0083	AWS:CloudTrail	DescribeInstances, DescribeServices, ListFunctions: High frequency enumeration calls or unusual user agents performing discovery

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
EnumerationRateThreshold	Rate of API calls used to enumerate services; tuned to reduce noise from automated inventory tools.
UserAgentFilter	Expected user agents for cloud management tools; deviations may indicate adversarial tools.

AN1128 · Identity Provider

Enumeration of directories, applications, or service principals through APIs such as Microsoft Graph or Okta API. Defender perspective includes unexpected listing of users, roles, applications, and abnormal access to identity management endpoints.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Logon Session CreationDC0067	azure:signinlogs	InteractiveUserLogin: Discovery behavior linked to privileged logins from atypical IP ranges
Cloud Service EnumerationDC0083	azure:audit	ListApplications, ListServicePrincipals: Large-scale queries against identity or application objects

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
QueryVolumeThreshold	Threshold for number of object enumeration calls before triggering detection.
PrivilegedRoleList	High-value identity roles (Global Admin, Application Admin) for targeted discovery monitoring.

AN1129 · Office Suite

Discovery of SaaS services connected to productivity platforms (e.g., Microsoft 365, Google Workspace). Defender perspective includes unexpected enumeration of enabled services, API integrations, or OAuth applications tied to user accounts.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Logon Session CreationDC0067	m365:signinlogs	UserLogin: Discovery operations shortly after account logins from new geolocations
Cloud Service EnumerationDC0083	m365:unified	Get-MsolServicePrincipal, ListAppRoles: Service discovery operations executed by accounts not normally performing administrative tasks

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MonitoredAppIntegrations	Specific Office Suite applications or plugins that may be enumerated or targeted.
GeoLocationDeviation	Geographic deviation threshold for discovery actions linked to recent logins.

AN1130 · SaaS

Discovery of connected SaaS applications, APIs, or configurations within platforms like Salesforce, Slack, or Zoom. Defender perspective includes enumeration of available integrations, abnormal querying of service metadata, and follow-on attempts to exploit or persist via discovered services.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Logon Session CreationDC0067	saas:auth	Login, TokenGranted: Discovery actions tied to anomalous login sessions or tokens
Cloud Service EnumerationDC0083	saas:adminapi	ListIntegrations, ListServices: Repeated service discovery requests from accounts without administrative responsibilities

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
IntegrationDiscoveryThreshold	Number of SaaS integrations enumerated before triggering detection.
ServiceAccountScope	Expected permissions for service accounts to distinguish benign from malicious discovery.

Tests3ExecutorsPowerShell 3Need elevation0 of 3Have prerequisites3Have cleanup1Platformsiaas:azure, iaas:aws

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Azure - Dump Subscription Data with MicroBurst

iaas:azure

PowerShell

—

Yes

Upon successful execution, this test will enumerate all resources that are contained within a valid Azure subscription. The resources enumerated will display on screen, as well as several csv files and folders will be output to a specified directory, listing what resources were discovered by the script. See https://dev.to/cheahengsoon/enumerating-subscription-information-with-microburst-35a1

Input arguments

Name	Type	Default	Description
password	string	T1082Az	Azure AD password
username	string	—	Azure AD username
output_directory	string	$env:temp\T1526Test1	Directory to output results to
subscription_name	string	—	Azure subscription name to scan

Attack command

import-module "PathToAtomicsFolder\..\ExternalPayloads\Get-AzDomainInfo.ps1"
$Password = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Password
Connect-AzAccount -Credential $Credential | out-null
Get-AzDomainInfo -folder #{output_directory} -subscription "#{subscription_name}" -verbose

Cleanup command

remove-item #{output_directory} -recurse -force -erroraction silentlycontinue

Prerequisite

The Get-AzDomainInfo script must exist in PathToAtomicsFolder\..\ExternalPayloads.

Check

if (test-path "PathToAtomicsFolder\..\ExternalPayloads\Get-AzDomainInfo.ps1"){exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
invoke-webrequest "https://raw.githubusercontent.com/NetSPI/MicroBurst/c771c665a2c71f9c5ba474869cd1c211ebee68fd/Az/Get-AzDomainInfo.ps1" -outfile "PathToAtomicsFolder\..\ExternalPayloads\Get-AzDomainInfo.ps1"

Prerequisite

The Az module must be installed.

Check

try {if (Get-InstalledModule -Name Az -ErrorAction SilentlyContinue) {exit 0} else {exit 1}} catch {exit 1}

Satisfy

Install-Module -Name Az -Force

GUID754adb89-c590-404b-a9b7-627afc431c70

AWS - Enumerate common cloud services

iaas:aws

PowerShell

—

Upon successful execution, this test will enumerate common resources that are contained within a valid AWS account.

Input arguments

Name	Type	Default	Description
profile	string		AWS profile
regions	string	us-east-1,us-east-2,us-west-1,us-west-2	AWS regions
access_key	string		AWS Access Key
secret_key	string		AWS Secret Key
session_token	string		AWS Session Token
output_directory	string	$env:TMPDIR/aws_discovery	Directory to output results to

Attack command

Import-Module "PathToAtomicsFolder\T1526\src\AWSDiscovery.ps1"
$access_key = "#{access_key}"
$secret_key = "#{secret_key}"
$session_token = "#{session_token}"
$aws_profile = "#{profile}"
$regions = "#{regions}"
Set-AWSAuthentication -AccessKey $access_key -SecretKey $secret_key -SessionToken $session_token -AWSProfile $aws_profile
Get-AWSDiscoveryData -Regions $regions -OutputDirectory "#{output_directory}"
Remove-BlankFiles -OutputDirectory "#{output_directory}"

Prerequisite

The AWS PowerShell module must be installed.

Check

try {if (Get-InstalledModule -Name AWSPowerShell -ErrorAction SilentlyContinue) {exit 0} else {exit 1}} catch {exit 1}

Satisfy

Install-Module -Name AWSPowerShell -Force

GUIDd373bf29-fa85-48d2-8732-8f141b680cab

Azure - Enumerate common cloud services

iaas:azure

PowerShell

—

Upon successful execution, this test will enumerate common resources that are contained within a valid Azure subscription.

Input arguments

Name	Type	Default	Description
cloud	string	AzureCloud	Azure cloud environment
client_id	string	—	Azure AD client ID
tenant_id	string	—	Azure AD tenant ID
client_secret	string	—	Azure AD client secret
output_directory	string	$env:TMPDIR/azure_discovery	Directory to output results to

Attack command

Import-Module "PathToAtomicsFolder\T1526\src\AzureDiscovery.ps1"
$client_id = "#{client_id}"
$client_secret = "#{client_secret}"
$tenant_id = "#{tenant_id}"
$environment = "#{cloud}"
Set-AzureAuthentication -ClientID $client_id -ClientSecret $client_secret -TenantID $tenant_id -Environment $environment
Get-AzureDiscoveryData -OutputDirectory "#{output_directory}" -Environment $environment
Remove-BlankFiles -OutputDirectory "#{output_directory}"

Prerequisite

The Az module must be installed.

Check

try {if (Get-InstalledModule -Name Az -ErrorAction SilentlyContinue) {exit 0} else {exit 1}} catch {exit 1}

Satisfy

Install-Module -Name Az -Force

GUID48ae7fde-2593-428e-8425-a7119bf83043

Tests from Atomic Red Team (MIT licence) · technique definition

Cloud Service Discovery detections T1526

11 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 23%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs