T1580 Cloud Infrastructure Discovery — Detection & Response
An adversary may attempt to discover resources that are available within an infrastructure-as-a-service (IaaS) environment. This includes the discovery of virtual machines, databases, snapshots, containers, serverless functions, and other cloud resources that may be targeted for data access, lateral movement, or impact.
Coverage at a glance
- Detections shipped
- 4
- Avg. verdict time
- < 5 min
- Data sources
- 3+
Threat context
How adversaries use T1580 Cloud Infrastructure Discovery — Detection & Response
An adversary may attempt to discover resources that are available within an infrastructure-as-a-service (IaaS) environment. This includes the discovery of virtual machines, databases, snapshots, containers, serverless functions, and other cloud resources that may be targeted for data access, lateral movement, or impact.
After gaining initial access to a cloud environment, adversaries systematically map the available infrastructure to identify high-value targets. This typically involves calling resource enumeration APIs across compute (EC2 DescribeInstances, Azure VM List), database (RDS DescribeDBInstances), snapshot (DescribeSnapshots — RDS and EBS snapshots often contain full database copies), and container services. Snapshot enumeration is particularly dangerous: public RDS snapshots are a common data exposure vector, and attackers who find private snapshots may copy them to an external account for analysis.
Detections ManySignal ships
Ready-to-deploy detection rules
| Rule name | Severity | Data source |
|---|---|---|
| EC2/RDS Snapshot Enumeration from New IAM Principal DescribeSnapshots or DescribeDBSnapshots called by an IAM principal with no prior history of snapshot access — potential reconnaissance for data extraction. | High | AWS CloudTrail |
| Cross-Region Infrastructure Discovery Burst Describe*/List* API calls made across 5 or more AWS regions within a 10-minute window — systematic infrastructure mapping across the full account. | High | AWS CloudTrail |
| Azure VM Scale Set and Managed Disk Enumeration Systematic listing of VMs, scale sets, managed disks, and snapshots across multiple resource groups — Azure infrastructure reconnaissance. | Medium | Azure Activity Logs |
| Container Registry Image Enumeration ECR DescribeRepositories and DescribeImages (or GCR equivalent) called across multiple registries — container image discovery for vulnerable or sensitive image content. | Medium | AWS CloudTrail / GCP Audit |
Related techniques and tactics
T1078 Valid Accounts — Detection & Response
ATT&CK Technique
T1110 Brute Force — Detection & Response
ATT&CK Technique
T1566 Phishing — Detection & Response
ATT&CK Technique
T1059 Command and Scripting Interpreter — Detection & Response
ATT&CK Technique
T1053 Scheduled Task/Job — Detection & Response
ATT&CK Technique
T1548 Abuse Elevation Control Mechanism — Detection & Response
ATT&CK Technique
T1068 Exploitation for Privilege Escalation — Detection & Response
ATT&CK Technique
T1134 Access Token Manipulation — Detection & Response
ATT&CK Technique
T1098 Account Manipulation — Detection & Response
ATT&CK Technique
T1136 Create Account — Detection & Response
ATT&CK Technique
T1556 Modify Authentication Process — Detection & Response
ATT&CK Technique
T1621 Multi-Factor Authentication Request Generation — Detection & Response
ATT&CK Technique
T1580 Cloud Infrastructure Discovery — Detection & Response: frequently asked questions
Why are RDS snapshots a specific concern for T1580?
RDS snapshots contain a full point-in-time copy of the database. An attacker who discovers and copies a private RDS snapshot to an external AWS account can restore the entire database, bypassing all application-layer access controls. This is one of the highest-impact cloud data exposure patterns.
How is T1580 different from T1526 (Cloud Service Discovery)?
T1526 focuses on discovering which cloud services are in use. T1580 focuses on discovering specific infrastructure resources within those services — VMs, databases, snapshots, containers. Both are Discovery techniques that typically occur in sequence.
Does ManySignal detect public snapshots?
Yes. ManySignal can query AWS Config for public EBS and RDS snapshots and alert on their existence. New public snapshots — particularly those not matching a known public AMI pattern — trigger immediate high-severity alerts.
Can this detection work in a multi-account AWS organisation?
Yes. ManySignal's AWS connector ingests CloudTrail from all accounts via the organisation trail, providing centralised visibility across the entire AWS organisation for cross-account infrastructure discovery patterns.
What is cross-account snapshot copying and why is it dangerous?
An IAM principal with ec2:ModifySnapshotAttribute and ec2:CopySnapshot permissions can share a private snapshot with an external AWS account and copy it there. Once in the attacker's account, the snapshot is entirely outside the victim's control. ManySignal detects the sharing and copying events immediately.
Does T1580 apply to Azure Disk snapshots?
Yes. Azure Managed Disk snapshots can be exported as SAS URLs or shared to external subscriptions. ManySignal detects unusual snapshot export or cross-subscription share operations in Azure Activity Logs.
How does ManySignal correlate T1580 with credential access events?
T1580 typically follows credential access (T1078, T1552) or exploitation. ManySignal's attack chain view links the credential access event to the subsequent infrastructure enumeration, providing the full kill chain context in a single investigation view.
What happens after infrastructure discovery in a typical cloud attack?
Common next steps include copying snapshots to external accounts (data theft), creating new EC2 instances for cryptomining (T1496), modifying security groups to open access, or creating new IAM admin accounts for persistence (T1098).
Can I get alerted when someone enumerates my serverless functions?
Yes. ListFunctions (Lambda), ListCloudFunctions (GCP Cloud Functions), and equivalent Azure Functions management API calls are detected as part of the infrastructure discovery detection ruleset.
Is there a way to restrict cross-region describe calls without breaking legitimate operations?
Yes. Use AWS Service Control Policies (SCPs) to restrict specific IAM actions to approved regions. For security accounts and break-glass credentials, allow all regions but monitor them with elevated alerting thresholds in ManySignal.
See the agentic SOC in action
Watch AI agents work a real alert queue — verdicts, evidence, and confidence scores included. In-house SOC or MDR, your call.