tfMITRE ATT&CK technique

Cloud Infrastructure Discovery T1580

Tactic: Discovery
Platform: IaaS
Version: 1.3
Created: 20 August 2020
Last modified: 12 May 2026
Contributors: Regina Elwell; Praetorian; Isif Ibrahima, Mandiant

An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-service (IaaS) environment. This includes compute service resources such as instances, virtual machines, and snapshots as well as resources of other services including the storage and database services.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups64th pct

Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware57th pct

Tools & malware57th percentile · 57% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules69th pct

Detection rules69th percentile · 69% of ATT&CK techniques have this many detection rules written or fewer.

Cloud Infrastructure Discovery MITRE reference T1580

64th pctamong all ATT&CK techniques for number of groups

3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

ShinyHuntersG1057 ↗

Has used Amazon Simple Storage Service (S3) Browser and WinSCP to collect information on S3 bucket configurations.1 2

created 2026-07-292 referencesaka UNC6240

Storm-0501G1053 ↗

Has enumerated compromised cloud environments to identify critical assets, data stores, and back resources.1

created 2025-10-191 reference

Scattered SpiderG1015 ↗

Enumerates cloud environments including Amazon Web Services (AWS) S3 buckets to identify server and backup management infrastructure, resource access, databases and storage containers .1 2 3

created 2023-07-053 referencesaka Roasted 0ktapus

All 3 groups for this technique

Offense vs defense T1580

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 5

first rule: 2021 Q2

Cloud Infrastructure Discovery detection strategy DET0169

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Cloud Infrastructure Discovery

Enterprise

1 platform

AN0481 · IaaS

Defenders should monitor for suspicious enumeration of cloud infrastructure components via APIs or CLI tools. Observable behaviors include repeated listing or description operations for compute instances, snapshots, storage buckets, and volumes. From a defender’s perspective, risky activity is often identified by new or untrusted identities making discovery calls (e.g., DescribeInstances, ListBuckets, az vm list, gcloud compute instances list), enumeration from unusual geolocations or IPs, or rapid multi-service discovery in sequence. Correlating discovery API usage with later snapshot creation or instance modification provides further context of adversary behavior.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Cloud Storage EnumerationDC0017	AWS:CloudTrail	ListBuckets
Instance EnumerationDC0075	AWS:CloudTrail	DescribeDBInstances
Instance MetadataDC0086	AWS:CloudTrail	DescribeInstances

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserContext	Identity performing the discovery operation; tuned to filter known administrative or inventory accounts.
GeoLocation	Source region or IP of discovery requests; tuned to expected operational regions to detect unusual access.
TimeWindow	Correlation period to link enumeration calls with subsequent provisioning or exfiltration activity.
APIThreshold	Rate or volume of discovery calls; tuned to suppress noise from inventory management tools.

Tests2Executorssh 1 · cmd 1Need elevation0 of 2Have prerequisites2Have cleanup1Platformslinux, macos, iaas:aws

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

AWS - EC2 Enumeration from Cloud Instance

linux, macos, iaas:aws

—

Yes

This atomic runs several API calls (sts:GetCallerIdentity, s3:ListBuckets, iam:GetAccountSummary, iam:ListRoles, iam:ListUsers, iam:GetAccountAuthorizationDetails, ec2:DescribeSnapshots, cloudtrail:DescribeTrails, guardduty:ListDetectors) from the context of an EC2 instance role. This simulates an attacker compromising an EC2 instance and running initial discovery commands on it. This atomic test leverages a tool called stratus-red-team built by DataDog (https://github.com/DataDog/stratus-red-team). Stratus Red Team is a self-contained binary. You can use it to easily detonate offensive attack techniques against a live cloud environment. Ref: https://stratus-red-team.cloud/attack-techniques/AWS/aws.discovery.ec2-enumerate-from-instance/

Input arguments

Name	Type	Default	Description
aws_region	string	us-west-2	AWS region to detonate
stratus_path	path	$PathToAtomicsFolder/T1580/src	Path of stratus binary

Attack command

export AWS_REGION=#{aws_region}
cd #{stratus_path}
echo "Stratus: Start Warmup."
./stratus warmup aws.discovery.ec2-enumerate-from-instance
echo "Stratus: Start Detonate."
./stratus detonate aws.discovery.ec2-enumerate-from-instance

Cleanup command

cd #{stratus_path}
echo "Stratus: Start Cleanup."
./stratus cleanup aws.discovery.ec2-enumerate-from-instance
echo "Removing Stratus artifacts from local machine."
rm -rf stratus*

Prerequisite

Stratus binary must be present at the (#{stratus_path}/stratus)

Check

if test -f "#{stratus_path}/stratus"; then exit 0; else exit 1; fi

Satisfy

if [ "$(uname)" = "Darwin" ]
then DOWNLOAD_URL=$(curl -s https://api.github.com/repos/DataDog/stratus-red-team/releases/latest | grep browser_download_url | grep -i Darwin_x86_64 | cut -d '"' -f 4); wget -q -O #{stratus_path}/stratus-red-team-latest.tar.gz $DOWNLOAD_URL
  tar -xzvf #{stratus_path}/stratus-red-team-latest.tar.gz --directory #{stratus_path}/
elif [ "$(expr substr $(uname) 1 5)" = "Linux" ]
then DOWNLOAD_URL=$(curl -s https://api.github.com/repos/DataDog/stratus-red-team/releases/latest | grep browser_download_url | grep -i linux_x86_64 | cut -d '"' -f 4); wget -q -O #{stratus_path}/stratus-red-team-latest.tar.gz $DOWNLOAD_URL
  tar -xzvf #{stratus_path}/stratus-red-team-latest.tar.gz --directory #{stratus_path}/
fi

Prerequisite

Check if ~/.aws/credentials file has a default stanza is configured

Check

cat ~/.aws/credentials | grep "default"

Satisfy

echo "Please install the aws-cli and configure your AWS default profile using: aws configure"

GUIDb2387d17-0151-4a45-87a4-6a2a6329418e

AWS - EC2 Security Group Enumeration

iaas:aws

cmd

—

Simulate an attacker's action to enumerate EC2 Security Groups in a compromised AWS environment.

Input arguments

Name	Type	Default	Description
aws_profile	string	default	AWS CLI profile name
output_format	string	json	Desired output format (text, table, json)

Attack command

aws ec2 describe-security-groups --profile #{aws_profile} --output #{output_format}

Prerequisite

AWS CLI installed and configured with the necessary access rights.

Check

type aws || aws --version

Satisfy

if [ "$(uname)" = "Darwin" ] || [ "$(expr substr $(uname) 1 5)" = "Linux" ]; then
  curl "https://aws.amazon.com/cli/" -o "Install-AWSCLI.sh" && sh Install-AWSCLI.sh
elif [ "$(expr substr $(uname) 1 5)" = "MINGW" ]; then
  Invoke-WebRequest -Uri "https://aws.amazon.com/cli/" -OutFile "Install-AWSCLI.ps1"; .\Install-AWSCLI.ps1
fi

Prerequisite

Check if AWS CLI is installed and configured.

Check

aws sts get-caller-identity --profile #{aws_profile}

Satisfy

if ! aws sts get-caller-identity --profile #{aws_profile}; then
  echo "AWS CLI not properly configured. Please configure AWS CLI."
fi

GUID43a61444-459c-4254-a0ed-e1418bf78a80

Tests from Atomic Red Team (MIT licence) · technique definition

Cloud Infrastructure Discovery detections T1580

7 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

69th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs