type: attack-pattern
spec_version: 2.1
id: attack-pattern--e24fcba8-2557-4442-a139-1ee2f2e784db
created: 2019-08-30T13:01:10.120Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1526
external_id: T1526
source_name: Azure AD Graph API
description: Microsoft. (2016, March 26). Operations overview | Graph API concepts. Retrieved June 18, 2020.
url: https://docs.microsoft.com/en-us/previous-versions/azure/ad/graph/howto/azure-ad-graph-api-operations-overview
source_name: Azure - Resource Manager API
description: Microsoft. (2019, May 20). Azure Resource Manager. Retrieved June 17, 2020.
url: https://docs.microsoft.com/en-us/rest/api/resources/
source_name: Azure - Stormspotter
description: Microsoft. (2020). Azure Stormspotter GitHub. Retrieved June 17, 2020.
url: https://github.com/Azure/Stormspotter
source_name: GitHub Pacu
description: Rhino Security Labs. (2019, August 22). Pacu. Retrieved October 17, 2019.
url: https://github.com/RhinoSecurityLabs/pacu
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:30.791Z
name: Cloud Service Discovery
description: An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Entra ID, etc. They may also include security services, such as AWS GuardDuty and Microsoft Defender for Cloud, and logging services, such as AWS CloudTrail and Google Cloud Audit Logs.

Adversaries may attempt to discover information about the services enabled throughout the environment. Azure tools and APIs, such as the Microsoft Graph API and Azure Resource Manager API, can enumerate resources and services, including applications, management groups, resources and policy definitions, and their relationships that are accessible by an identity.(Citation: Azure - Resource Manager API)(Citation: Azure AD Graph API)

For example, Stormspotter is an open source tool for enumerating and constructing a graph for Azure resources and services, and Pacu is an open source AWS exploitation framework that supports several methods for discovering cloud services.(Citation: Azure - Stormspotter)(Citation: GitHub Pacu)

Adversaries may use the information gained to shape follow-on behaviors, such as targeting data or credentials from enumerated services or evading identified defenses through [Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001) or [Disable or Modify Cloud Logs](https://attack.mitre.org/techniques/T1562/008).
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: discovery
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Suzy Schapperle - Microsoft Azure Red Team
Praetorian
Thanabodi Phrakhun, I-SECURE
Arun Seelagan, CISA
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: IaaS
Identity Provider
Office Suite
SaaS
x_mitre_version: 1.4