MITRE ATT&CKtechnique
T1619 Cloud Storage Object Discovery
- Domain
- enterprise
- Tactics
- Discovery
- Platforms
- IaaS
- Version
- 1.0
- Created
- 2021-10-01
Description
Adversaries may enumerate objects in cloud storage infrastructure. Adversaries may use this information during automated discovery to shape follow-on behaviors, including requesting all or specific objects from cloud storage. Similar to File and Directory Discovery on a local host, after identifying available storage services (i.e. Cloud Infrastructure Discovery) adversaries may access the contents/objects stored in cloud infrastructure.
Cloud service providers offer APIs allowing users to enumerate objects stored within cloud storage. Examples include ListObjectsV2 in AWS and List Blobs in Azure .
Related
Tactic · MITRE ATT&CK (1)
- TA0007 Discovery tactic
Referenced by MITRE ATT&CK · mitigates (1)
- M1018 User Account Management mitigation
Referenced by MITRE ATT&CK · uses (4)
Referenced by Compliance · mitigates (8)
- CIS-6.8 Define and Maintain Role-Based Access Control CIS Safeguard v8.1
- NIST-AC-17 Remote Access NIST 800-53 control
- NIST-AC-2 Account Management NIST 800-53 control
- NIST-AC-3 Access Enforcement NIST 800-53 control
- NIST-AC-5 Separation of Duties NIST 800-53 control
- NIST-AC-6 Least Privilege NIST 800-53 control
- NIST-CM-5 Access Restrictions for Change NIST 800-53 control
- NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control