Techniques › T1619
T1619 Cloud Storage Object Discovery
discovery — IaaS · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
1
Sigma rules tagged attack.t1619
0
KEV CVEs mapped here
<p>Adversaries may enumerate objects in cloud storage infrastructure. Adversaries may use this information during automated discovery to shape follow-on behaviors, including requesting all or specific objects from cloud storage. Similar to File and Directory Discovery on a local host, after identifying available storage services (i.e. Cloud Infrastructure Discovery) adversaries may access the contents/objects stored in cloud infrastructure.</p><p>Cloud service providers offer APIs allowing users to enumerate objects stored within cloud storage. Examples include ListObjectsV2 in AWS and List Blobs in Azure .</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0578 Detection Strategy for Cloud Storage Object Discovery v1.0
AN1594 IaaSDetection of suspicious enumeration of cloud storage objects via API calls such as AWS S3 ListObjectsV2, Azure List Blobs, or GCP ListObjects. Correlate access with account role, user context, and prior authentication activity to identify anomalous usage patterns (e.g., unusual account, unexpected regions, or large-scale enumeration in short time windows).Tunable:
TimeWindowUserContextRegionScope
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1619
Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io
· 2023-01-06 (modified 2024-07-10) · logsource: product=aws service=cloudtrail · f305fd62-beca-47da-ad95-7690a0620084
Looks for potential enumeration of AWS buckets via ListBuckets.