Scattered SpiderG1015 ↗
Abused AWS Systems Manager Inventory to identify targets on the compromised network prior to lateral movement.1
tfMITRE ATT&CK technique
Cloud Service Dashboard T1538
- Tactic
- Discovery
- Platforms
- IaaS, SaaS, Office Suite, Identity Provider
- Version
- 1.5
- Created
- 30 August 2019
- Last modified
- 24 October 2025
- Contributors
- Praetorian; Obsidian Security
An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment, such as specific services, resources, and features. For example, the GCP Command Center can be used to view all assets, review findings of potential security risks, and run additional queries, such as finding public IP addresses and open ports.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
1
Threat groups45th pct
Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.1
Detection rules42nd pct
Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.