Analytics Informational
✕

Cloud infrastructure enumeration activity

A cloud identity attempted to discover available resources within the cloud environment. This may indicate an adversary attempting to map the organization's cloud environment and discover cloud resources that may assist to perform additional attacks within the environment.

Module:
Cortex Cloud
Licensed by:
Cloud Runtime Security (CRS)
Data source:
AWS Audit Log, Gcp Audit Log
ATT&CK tactics: Discovery (TA0007)
ATT&CK techniques: Cloud Infrastructure Discovery (T1580) Cloud Service Discovery (T1526)
Attacker's goals:

Map the cloud environment and detect potential resources to abuse.

Investigative actions:

Check the identity's role designation in the organization. Identify which available resources were discovered. Investigate if the discovered resources were used to extract sensitive information or perform other attacks in the cloud environment.

Test period:
10 Minutes
Deduplication:
5 Days
1 variation:
  • Suspicious cloud infrastructure enumeration activity Low (parent: Informational)