Cloud Storage Object Discovery
- ID
- T1619
- Tactics
- TA0007 Discovery
- Platforms
- IaaS
- Data sources
- Cloud Storage Enumeration, Cloud Storage Access
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Adversaries may enumerate objects in cloud storage infrastructure. Adversaries may use this information during automated discovery to shape follow-on behaviors, including requesting all or specific objects from cloud storage. Similar to File and Directory Discovery on a local host, after identifying available storage services (i.e. Cloud Infrastructure Discovery) adversaries may access the contents/objects stored in cloud infrastructure.
Cloud service providers offer APIs allowing users to enumerate objects stored within cloud storage. Examples include ListObjectsV2 in AWS [1] and List Blobs in Azure[2] .
Detection
- DET0578 Detection Strategy for Cloud Storage Object Discovery
Data components: Cloud Storage Enumeration, Cloud Storage Access
Mitigations (1)
- M1018 User Account Management
Restrict granting of permissions related to listing objects in cloud storage to necessary accounts.