Cloud Service Discovery `T1526`

Tactic: Discovery

An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Entra ID, etc. They may also include security services, such as AWS GuardDuty and Microsoft Defender for Cloud, and logging services, such as AWS CloudTrail and Google Cloud Audit Logs.

Events covered

2 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Defender-IdentityInfo	any	Identity information

Authoring guide

These 51 rules share fields, values, and exclusions.

Fields filtered most (92 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`data_stream.dataset`	13	`eq` 12, `in` 1	`aws.cloudtrail`, `azure.aadgraphactivitylogs`, `azure.signinlogs`, `azure.activitylogs`, `azure.auditlogs`
`EventType`	9	`in` 5, `eq` 4, `ne` 1	`AssumeRoleWithWebIdentity`, `AttachRolePolicy`, `Converse`, `ConverseStream`, `CreateAccessKey`
`Provider_Name`	7	`eq` 5, `in` 2	`bedrock.amazonaws.com`, `cloudtrail.amazonaws.com`, `dynamodb.amazonaws.com`, `backup.amazonaws.com`, `cloudfront.amazonaws.com`
`sourcetype`	7	`eq` 7	`aws:cloudwatchlogs:eks`, `azure:monitor:aad`, `aws:cloudtrail`, `google:gcp:pubsub:message`, `kube:objects:events`
`aws::userIdentity.type`	5	`eq` 3, `ne` 2	`AWSService`, `AWSAccount`, `AssumedRole`, `IAMUser`
`event.outcome`	5	`eq` 5	`success`
`aws::errorCode`	4	`eq` 3, `is_null` 1	`AccessDenied`, , `VpceAccessDenied`
`aws::eventName`	3	`eq` 1, `in` 1, `starts_with` 1	`Describe`, `Get`, `List*`, `ModifyDocumentPermission`, `PutConfigurationRecorder`
`aws::userAgent`	3	`eq` 1, `is_not_null` 1, `regex_match` 1	, `(azure\|sharp\|blood)(hound)/.*`, `Mozilla/5.0 (Windows NT 10.0; Win64; x64)...`
`aws::userIdentity.accessKeyId`	3	`starts_with` 3	`AKIA*`
`category`	3	`eq` 2, `in` 1	`MicrosoftGraphActivityLogs`, `NonInteractiveUserSignInLogs`, `kube-audit`
`src_ip`	3	`is_not_null` 3
`user`	3	`ne` 2, `starts_with` 1	`AWSServiceRoleForConfig`, `Unknown`, `system:serviceaccount:*`
`Message`	2	`contains` 1, `eq` 1	`Unauthorized access attempt`, `UserSignIn`
`aws::sessionCredentialFromConsole`	2	`is_null` 2

Top indicator values (330 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS Bedrock Foundation Model Enumeration Followed by Invocation via Long-Term Key elasticAWS Discovery API Calls via CLI from a Single Resource elasticAWS S3 Rapid Bucket Posture API Calls from a Single Principal elasticAWS Service Quotas Multi-Region GetServiceQuota Requests	4	40
`data_stream.dataset`	`eq`	`azure.aadgraphactivitylogs` elasticAzure AD Graph Access with Suspicious User-Agent elasticAzure AD Graph High 4xx Error Ratio from User elasticAzure AD Graph Potential Enumeration (ROADrecon) elasticEntra ID OAuth Device Code Sign-in to Azure AD Graph Enumeration	4	4
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS Backup Resource Enumeration via Long-Term Access Key elasticAWS SES Enumeration via Long-Term Access Key	2	143
`aws::userIdentity.accessKeyId`	`starts_with`	`AKIA*` elasticAWS Backup Resource Enumeration via Long-Term Access Key elasticAWS Bedrock Foundation Model Enumeration Followed by Invocation via Long-Term Key elasticAWS SES Enumeration via Long-Term Access Key	3	5
`event.outcome`	`eq`	`success` elasticAWS Bedrock Foundation Model Enumeration Followed by Invocation via Long-Term Key elasticAWS S3 Rapid Bucket Posture API Calls from a Single Principal elasticEntra ID OAuth Device Code Sign-in to Azure AD Graph Enumeration	3	82
`event.outcome`	`eq`	`success` elasticAWS Backup Resource Enumeration via Long-Term Access Key elasticAWS SES Enumeration via Long-Term Access Key	2	306
`src_ip`	`is_not_null`	elasticAWS Discovery API Calls via CLI from a Single Resource elasticAWS S3 Rapid Bucket Posture API Calls from a Single Principal elasticGCP Secret Manager ListSecrets Across Multiple Projects	3	70
`aws::errorCode`	`eq`	`AccessDenied` pantherDetect Reconnaissance from IAM Users pantherMonitor Unauthorized API Calls	2	3
`aws::sessionCredentialFromConsole`	`is_null`	elasticAWS Discovery API Calls via CLI from a Single Resource elasticAWS S3 Rapid Bucket Posture API Calls from a Single Principal	2	2
`aws::userIdentity.arn`	`is_not_null`	elasticAWS Discovery API Calls from VPN ASN for the First Time by Identity elasticAWS S3 Rapid Bucket Posture API Calls from a Single Principal	2	10
`aws::userIdentity.type`	`ne`	`AWSService` elasticAWS Discovery API Calls via CLI from a Single Resource elasticAWS S3 Rapid Bucket Posture API Calls from a Single Principal	2	7
`sourcetype`	`eq`	`aws:cloudwatchlogs:eks` splunkAmazon EKS Kubernetes cluster scan detection splunkAmazon EKS Kubernetes Pod scan detection	2	2
`sourcetype`	`eq`	`azure:monitor:aad` splunkAzure AD AzureHound UserAgent Detected splunkAzure AD Service Principal Enumeration	2	47
`user.username`	`eq`	`system:anonymous` splunkAmazon EKS Kubernetes cluster scan detection splunkAmazon EKS Kubernetes Pod scan detection	2	3
`Active`	`eq`	`true` kustoDataverse - TI map IP to DataverseActivity	1	60
`AlertSeverity`	`contains`	`High` kustoSuspicious VM Instance Creation Activity Detected	1
`AlertSeverity`	`contains`	`Medium` kustoSuspicious VM Instance Creation Activity Detected	1
`AppId`	`eq`	`51f81489-12ee-4a9e-aaae-a2591f45987d` kustoDataverse - Suspicious use of Web API	1
`Category`	`eq`	`audit.security-events` kustoSAP BTP - Failed access attempts across multiple BAS subaccounts	1	6
`ClientIp`	`is_not_null`	kustoDataverse - Honeypot instance activity	1	2
`CommandLine`	`contains`	`-group=all` sigmaPUA - Seatbelt Execution	1
`CommandLine`	`contains`	`-group=chromium` sigmaPUA - Seatbelt Execution	1
`CommandLine`	`contains`	`-group=misc` sigmaPUA - Seatbelt Execution	1
`CommandLine`	`contains`	`-group=remote` sigmaPUA - Seatbelt Execution	1
`CommandLine`	`contains`	`-group=slack` sigmaPUA - Seatbelt Execution	1
`CommandLine`	`contains`	`-group=system` sigmaPUA - Seatbelt Execution	1
`CommandLine`	`contains`	`-group=user` sigmaPUA - Seatbelt Execution	1
`CommandLine`	`contains`	`-outputfile=` sigmaPUA - Seatbelt Execution	1
`CommandLine`	`contains`	`CertificateThumbprints` sigmaPUA - Seatbelt Execution	1
`CommandLine`	`contains`	`ChromiumBookmarks` sigmaPUA - Seatbelt Execution	1

Exclusions (19 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`eventCategory`	`ne`	`NetworkActivity` pantherExternal Principal Accessing AWS Resources Via VPC Endpoint pantherSensitive API Calls Via VPC Endpoint pantherVPC Endpoint Access Denied	3
`eventType`	`ne`	`AwsVpceEvent` pantherExternal Principal Accessing AWS Resources Via VPC Endpoint pantherSensitive API Calls Via VPC Endpoint pantherVPC Endpoint Access Denied	3
`KmsKeyId`	`is_not_null`	pantherAWS CloudTrail Log Encryption	1
`Labels`	`contains`	`Synced` kustoSOCRadar Unsynced Closed Incident	1
`aws::errorCode`	`is_not_null`	pantherAWS Config Service Created	1
`aws::errorMessage`	`is_not_null`	pantherAWS Config Service Created	1
`aws::eventName`	`in`	`DescribeEventAggregates` pantherMonitor Unauthorized API Calls	1
`aws::eventName`	`in`	`ListResourceTags` pantherMonitor Unauthorized API Calls	1
`aws::userIdentity.arn`	`contains`	`AWSServiceRoleForConfig` elasticAWS Discovery API Calls from VPN ASN for the First Time by Identity	1
`aws::userIdentity.type`	`eq`	`AWSService` elasticAWS Discovery API Calls from VPN ASN for the First Time by Identity	1
`objectRef.name`	`in`	`falco` splunkKubernetes Suspicious Image Pulling	1
`objectRef.name`	`in`	`splunk` splunkKubernetes Suspicious Image Pulling	1
`operationName`	`starts_with`	`Add` pantherAzure Policy Changed	1
`operationName`	`starts_with`	`Added` pantherAzure Policy Changed	1
`properties.result`	`ne`	`success` pantherAzure Policy Changed	1

Cloud Service Discovery `T1526`

Events covered

Authoring guide

Fields filtered most (92 distinct)

Top indicator values (330 distinct)

Exclusions (19 distinct)

Rules under this technique

Sigma 3 rules

Elastic 22 rules

Splunk 8 rules

Kusto 9 rules

Panther 9 rules

Cloud Service Discovery T1526

Events covered

Authoring guide

Fields filtered most (92 distinct)

Top indicator values (330 distinct)

Exclusions (19 distinct)

Rules under this technique

Sigma 3 rules

Elastic 22 rules

Splunk 8 rules

Kusto 9 rules

Panther 9 rules

Cloud Service Discovery `T1526`