DC0075 Instance Enumeration
| Item | Value |
|---|---|
| ID | DC0075 |
| Version | 2.0 |
| Created | 20 October 2021 |
| Last Modified | 21 October 2025 |
Log Sources
| Name | Channel |
|---|---|
| AWS:CloudTrail | DescribeDBInstances |
| AWS:CloudTrail | DescribeInstances, GetConsoleOutput, DescribeImages |
| azure:activity | MICROSOFT.COMPUTE/VIRTUALMACHINES/LIST |
| azure:activity | Microsoft.Compute/virtualMachines/read |
| gcp:audit | compute.instances.list OR storage.buckets.list |
Detection Strategy
| ID | Name | Technique Detected |
|---|---|---|
| DET0169 | Detection Strategy for Cloud Infrastructure Discovery | T1580 |
| DET0525 | System Discovery via Native and Remote Utilities | T1082 |