T1526 Cloud Service Discovery — Detection & Response
An adversary may attempt to enumerate the cloud services running in an environment. Various cloud providers offer APIs that allow users to query what services are being used. Adversaries may use these APIs to gain visibility into the cloud environment, identifying resources, service accounts, storage buckets, and other assets that may be targeted for data access or lateral movement.
Coverage at a glance
- Detections shipped
- 4
- Avg. verdict time
- < 5 min
- Data sources
- 3+
Threat context
How adversaries use T1526 Cloud Service Discovery — Detection & Response
An adversary may attempt to enumerate the cloud services running in an environment. Various cloud providers offer APIs that allow users to query what services are being used. Adversaries may use these APIs to gain visibility into the cloud environment, identifying resources, service accounts, storage buckets, and other assets that may be targeted for data access or lateral movement.
Following initial access to a cloud environment — typically through stolen credentials or a compromised EC2/VM instance — adversaries run a systematic enumeration of cloud services. Common patterns include calling ListBuckets, DescribeInstances, ListFunctions, and GetCallerIdentity APIs across AWS, or equivalent calls in Azure and GCP. Cloud service discovery is low-cost for the attacker but high-signal for defenders: an IAM user or role that suddenly calls 20+ AWS describe/list APIs within a minute is not consistent with normal application behaviour.
Detections ManySignal ships
Ready-to-deploy detection rules
| Rule name | Severity | Data source |
|---|---|---|
| AWS Enumerate All Services API Burst A single IAM principal calls more than 15 distinct List*/Describe* API operations across 3 or more AWS services within a 5-minute window — cloud asset enumeration pattern. | High | AWS CloudTrail |
| GetCallerIdentity Called from New IP aws sts get-caller-identity called from a source IP not previously seen for this IAM principal — credential validation step in cloud recon. | Medium | AWS CloudTrail |
| Azure Subscription List by Service Principal at Unusual Time A service principal enumerates all Azure subscriptions outside of its normal operational hours — potential lateral discovery in a multi-subscription environment. | Medium | Azure Activity Logs |
| Cloud Function and Lambda Enumeration Burst ListFunctions (AWS Lambda) or ListCloudFunctions (GCP) called alongside DescribeFunctionConfiguration — discovery of serverless attack surface. | High | AWS CloudTrail / GCP Audit |
Related techniques and tactics
T1078 Valid Accounts — Detection & Response
ATT&CK Technique
T1110 Brute Force — Detection & Response
ATT&CK Technique
T1566 Phishing — Detection & Response
ATT&CK Technique
T1059 Command and Scripting Interpreter — Detection & Response
ATT&CK Technique
T1053 Scheduled Task/Job — Detection & Response
ATT&CK Technique
T1548 Abuse Elevation Control Mechanism — Detection & Response
ATT&CK Technique
T1068 Exploitation for Privilege Escalation — Detection & Response
ATT&CK Technique
T1134 Access Token Manipulation — Detection & Response
ATT&CK Technique
T1098 Account Manipulation — Detection & Response
ATT&CK Technique
T1136 Create Account — Detection & Response
ATT&CK Technique
T1556 Modify Authentication Process — Detection & Response
ATT&CK Technique
T1621 Multi-Factor Authentication Request Generation — Detection & Response
ATT&CK Technique
T1526 Cloud Service Discovery — Detection & Response: frequently asked questions
Why would an attacker need to discover cloud services if they already have credentials?
Stolen credentials often come without context about what the account can access. Cloud service discovery gives the attacker a map of the environment — what services exist, what resources they contain, and which IAM permissions the account has. This guides further exploitation.
Is GetCallerIdentity a red flag by itself?
GetCallerIdentity is used by many legitimate tools and SDK health checks. Context matters: a new IP, an unused IAM user making the call, or GetCallerIdentity immediately followed by enumeration API calls are the concerning patterns.
How does ManySignal detect cloud discovery without generating excessive false positives?
ManySignal builds per-principal baseline models of normal API call patterns. Deviations — particularly calls to service APIs not previously used by a given principal — are scored as anomalous even if no single call is malicious in isolation.
Does this apply to GCP environments?
Yes. GCP Cloud Audit Logs capture ResourceManager and service API enumeration calls. ManySignal applies equivalent detection logic across AWS, Azure, and GCP using the same OCSF-normalised event model.
Can cloud discovery be automated by a legitimate application?
Yes — monitoring tools, infrastructure-as-code, and management scripts legitimately enumerate cloud services. ManySignal distinguishes legitimate automation by IAM principal type, call source, time of day, and whether the enumeration pattern is consistent with the principal's established baseline.
What typically happens after cloud service discovery in an attack?
After discovery, adversaries focus on data access (S3 bucket contents, database dumps) or privilege escalation (modifying IAM policies, creating new admin accounts). ManySignal correlates T1526 discoveries with subsequent T1530 (Cloud Storage Data) or T1098 (Account Manipulation) events.
Does ManySignal detect Pacu, Prowler, or other cloud attack frameworks?
ManySignal detects the behavioural patterns generated by these tools (rapid API enumeration bursts) regardless of the specific tool used. Some tools have unique API call signatures that enable tool-specific detection rules.
How are service-linked roles treated in discovery detection?
AWS service-linked roles make legitimate enumeration calls as part of their function. ManySignal suppresses alerts for service-linked role enumeration calls that match the expected patterns for the associated service.
Is there a way to limit blast radius if cloud discovery occurs?
Yes. Resource-based policies, S3 bucket policies with restricted IAM principal conditions, and SCP guardrails can limit what an attacker can access even if discovery succeeds. ManySignal's response automation can also apply restrictive SCPs on an account during active investigation.
Does this technique apply to SaaS-hosted cloud environments?
For SaaS platforms (Salesforce, Workday) hosted in cloud, the equivalent discovery technique is accessing directory APIs or reporting APIs to enumerate users and data. ManySignal applies analogous detection logic per-platform.
See the agentic SOC in action
Watch AI agents work a real alert queue — verdicts, evidence, and confidence scores included. In-house SOC or MDR, your call.