Cross-source coverage
T1526 / ATT&CK
Cloud Service Discovery
60 rules across 7 sources.
From MITRE ATT&CK 19.2
An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Entra ID, etc. They may also include security services, such as AWS GuardDuty and Microsoft Defender for Cloud, and logging services, such as AWS CloudTrail and Google Cloud Audit Logs.
Adversaries may attempt to discover information about the services enabled throughout the environment. Azure tools and APIs, such as the Microsoft Graph API and Azure Resource Manager API, can enumerate resources and services, including applications, management groups, resources and policy definitions, and their relationships that are accessible by an identity.
For example, Stormspotter is an open source tool for enumerating and constructing a graph for Azure resources and services, and Pacu is an open source AWS exploitation framework that supports several methods for discovering cloud services.
Adversaries may use the information gained to shape follow-on behaviors, such as targeting data or credentials from enumerated services or evading identified defenses through Disable or Modify Tools or Disable or Modify Cloud Log.
- Tactics
- Discovery
- Platforms
- IaaS · Identity Provider · Office Suite · SaaS
- Telemetry
-
AWS:CloudTrailazure:auditazure:signinlogsm365:unifiedm365:signinlogssaas:adminapisaas:auth
How MITRE says to detect it DET0402
Detection Strategy for Cloud Service Discovery
IaaS Analytic 1127
Unusual enumeration of services and resources through cloud APIs such as AWS CLI `describe-*`, Azure Resource Manager queries, or GCP project listings. Defender perspective includes anomalous API calls, unexpected volume of service enumeration, and correlation of discovery with recently compromised sessions.
AWS:CloudTrailDescribeInstances, DescribeServices, ListFunctions: High frequency enumeration calls or unusual user agents performing discoveryAWS:CloudTrailAssumeRole: Discovery actions tied to assumed identities outside of normal context
Identity Provider Analytic 1128
Enumeration of directories, applications, or service principals through APIs such as Microsoft Graph or Okta API. Defender perspective includes unexpected listing of users, roles, applications, and abnormal access to identity management endpoints.
azure:auditListApplications, ListServicePrincipals: Large-scale queries against identity or application objectsazure:signinlogsInteractiveUserLogin: Discovery behavior linked to privileged logins from atypical IP ranges
Office Suite Analytic 1129
Discovery of SaaS services connected to productivity platforms (e.g., Microsoft 365, Google Workspace). Defender perspective includes unexpected enumeration of enabled services, API integrations, or OAuth applications tied to user accounts.
m365:unifiedGet-MsolServicePrincipal, ListAppRoles: Service discovery operations executed by accounts not normally performing administrative tasksm365:signinlogsUserLogin: Discovery operations shortly after account logins from new geolocations
SaaS Analytic 1130
Discovery of connected SaaS applications, APIs, or configurations within platforms like Salesforce, Slack, or Zoom. Defender perspective includes enumeration of available integrations, abnormal querying of service metadata, and follow-on attempts to exploit or persist via discovered services.
saas:adminapiListIntegrations, ListServices: Repeated service discovery requests from accounts without administrative responsibilitiessaas:authLogin, TokenGranted: Discovery actions tied to anomalous login sessions or tokens
elastic/detection-rules
19 rules| Detection | Severity | Format |
|---|---|---|
| AWS Bedrock Foundation Model Enumeration Followed by Invocation via Long-Term Key | High | Elastic TOML |
| AWS Discovery API Calls from VPN ASN for the First Time by Identity | High | Elastic TOML |
| AWS Lateral Movement from Kubernetes SA via AssumeRoleWithWebIdentity | High | Elastic TOML |
| Azure AD Graph Access with Suspicious User-Agent | High | Elastic TOML |
| Azure AD Graph Potential Enumeration (ROADrecon) | High | Elastic TOML |
| Entra ID OAuth Device Code Sign-in to Azure AD Graph Enumeration | High | Elastic TOML |
| Entra ID Sign-in BloodHound Suite User-Agent Detected | High | Elastic TOML |
| Entra ID Sign-in TeamFiltration User-Agent Detected | High | Elastic TOML |
| Azure AD Graph High 4xx Error Ratio from User | Medium | Elastic TOML |
| Microsoft Graph Multi-Category Reconnaissance Burst | Medium | Elastic TOML |
+ 9 more from elastic/detection-rules → showing the 10 highest-severity
socfortress/Wazuh-Rules
18 rules| Detection | Severity | Format |
|---|---|---|
| operation. · office_365.LogonError = MisconfiguredApplicationWithReasonsListed | Low | Wazuh XML |
| operation. · office_365.Operation = AnalyzedByExternalApplication | Low | Wazuh XML |
| operation. · office_365.Operation = GetAllGatewayClusterDatasources | Low | Wazuh XML |
| operation. · office_365.Operation = Get-ComplianceSearchAction | Low | Wazuh XML |
| operation. · office_365.Operation = Get-CSSimpleUrlConfiguration | Low | Wazuh XML |
| operation. · office_365.Operation = Get-CsTeamsUpgradeOverridePolicy | Low | Wazuh XML |
| operation. · office_365.Operation = GetGatewayClusterDatasourceStatus | Low | Wazuh XML |
| operation. · office_365.Operation = GetGatewayClusters | Low | Wazuh XML |
| operation. · office_365.Operation = GetGatewayClusterStatus | Low | Wazuh XML |
| operation. · office_365.Operation = GetGatewayClusterSupportedDatasources | Low | Wazuh XML |
+ 8 more from socfortress/Wazuh-Rules → showing the 10 highest-severity
splunk/security_content
8 rules| Detection | Severity | Format |
|---|---|---|
| Amazon EKS Kubernetes cluster scan detection | Undefined | SPL |
| Amazon EKS Kubernetes Pod scan detection | Undefined | SPL |
| AWS Excessive Security Scanning | Undefined | SPL |
| Azure AD AzureHound UserAgent Detected | Undefined | SPL |
| Azure AD Service Principal Enumeration | Undefined | SPL |
| GCP Kubernetes cluster pod scan detection | Undefined | SPL |
| Kubernetes Scanner Image Pulling | Undefined | SPL |
| Kubernetes Suspicious Image Pulling | Undefined | SPL |
panther-labs/panther-analysis
7 rules| Detection | Severity | Format |
|---|---|---|
| External Principal Accessing AWS Resources Via VPC Endpoint | Medium | Panther Python |
| Sensitive API Calls Via VPC Endpoint | Medium | Panther Python |
| VPC Endpoint Access Denied | Medium | Panther Python |
| Azure Policy Changed | Low | Panther Python |
| AWS Config Service Created | Informational | Panther Python |
| Detect Reconnaissance from IAM Users | Informational | Panther Python |
| Monitor Unauthorized API Calls | Informational | Panther Python |
Wazuh Core Ruleset
4 rules| Detection | Severity | Format |
|---|---|---|
| Office 365: Changed eDiscovery administrator membership | Medium | Wazuh XML |
| Office 365: Created content search | Medium | Wazuh XML |
| Office 365: Created eDiscovery administrator | Medium | Wazuh XML |
| Office 365: Created eDiscovery case | Medium | Wazuh XML |
SigmaHQ/sigma
3 rules| Detection | Severity | Format |
|---|---|---|
| Discovery Using AzureHound | High | Sigma |
| PUA - Seatbelt Execution | High | Sigma |
| Github Self Hosted Runner Changes Detected | Low | Sigma |
Azure/Azure-Sentinel
1 rule| Detection | Severity | Format |
|---|---|---|
| Suspicious VM Instance Creation Activity Detected | Medium | KQL |