T1619 Cloud Storage Object Discovery
Adversaries may enumerate objects in cloud storage infrastructure. Adversaries may use this information during automated discovery to shape follow-on behaviors, including requesting all or specific objects from cloud storage. Similar to File and Directory Discovery on a local host, after identifying available storage services (i.e. Cloud Infrastructure Discovery) adversaries may access the contents/objects stored in cloud infrastructure.
Cloud service providers offer APIs allowing users to enumerate objects stored within cloud storage. Examples include ListObjectsV2 in AWS and List Blobs in Azure .
| Item |
Value |
| ID |
T1619 |
| Sub-techniques |
|
| Tactics |
TA0007 |
| Platforms |
IaaS |
| Version |
1.0 |
| Created |
01 October 2021 |
| Last Modified |
11 April 2022 |
Procedure Examples
Mitigations
| ID |
Mitigation |
Description |
| M1018 |
User Account Management |
Restrict granting of permissions related to listing objects in cloud storage to necessary accounts. |
Detection
References