T1526Discovery
Cloud Service Discovery
An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Entra ID, etc.…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
3 Sigma rules tagged T1526Cloud Service DiscoveryT15263 general rules
- Discovery Using AzureHoundhightest
- PUA - Seatbelt Executionhightest
- Github Self Hosted Runner Changes Detectedlowtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Cloud Service Discovery
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.