T1526 — Cloud Service Discovery

Tactic: Discovery · Platforms: IaaS, Identity Provider, Office Suite, SaaS

An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can…

Sigma detection rules (4)

T1526 Cloud Service Discovery

title: T1526 Cloud Service Discovery
id: 572125a6-9b94-468a-bf86-0d53fb50bd04
description: 'Detection Strategy for Cloud Service Discovery. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: EnumerationRateThreshold, UserAgentFilter.'
references:
  - https://attack.mitre.org/techniques/T1526
author: Shahrukh Khan
date: 2026-04-17
license: MIT
tags:
  - attack.discovery
  - attack.t1526

logsource:
  category: cloudtrail
  product: aws

detection:
  selection_tooling:
    userAgent|contains:
      - 'pacu'
      - 'ScoutSuite'
      - 'CloudMapper'
      - 'cloudfox'

  condition: selection_tooling

falsepositives:
  - Authorized cloud security assessments or internal asset inventory jobs using the same open source enumeration tooling; a rate-based enumeration threshold across many service APIs requires a correlation rule that CloudTrail alone cannot express per-event.

level: high

T1526 Cloud Service Discovery

title: T1526 Cloud Service Discovery
id: da62b5a3-9d2e-4a7f-931b-536d6ceb0361
description: 'Detection Strategy for Cloud Service Discovery. (Data Component: Cloud Service Enumeration; baseline tier: fallback.) Tune using: IntegrationDiscoveryThreshold, ServiceAccountScope.'
references:
  - https://attack.mitre.org/techniques/T1526
author: Shahrukh Khan
date: 2026-06-02
license: MIT
tags:
  - attack.discovery
  - attack.t1526

logsource:
  product: saas
  service: adminapi

detection:
  selection_enum:
    event_type:
      - 'integration_enumerated'
      - 'connected_app_list_viewed'

  condition: selection_enum

falsepositives:
  - Administrators or integration developers routinely reviewing the connected-app marketplace as part of normal SaaS administration.

level: informational

T1526 Cloud Service Discovery

title: T1526 Cloud Service Discovery
id: 3535df09-0005-4359-94a1-58b47ece0520
description: 'Detection Strategy for Cloud Service Discovery. (Data Component: Cloud Service Enumeration; baseline tier: fallback.) Tune using: QueryVolumeThreshold, PrivilegedRoleList.'
references:
  - https://attack.mitre.org/techniques/T1526
author: Shahrukh Khan
date: 2026-04-25
license: MIT
tags:
  - attack.discovery
  - attack.t1526

logsource:
  product: azure
  service: audit

detection:
  selection:
    OperationName: 'Read'
  roles:
    TargetResources|contains: 'directoryRoles'

  condition: selection and roles

falsepositives:
  - Entra ID audit logs are write-focused, so enumeration of roles or service configurations via read-only Graph API calls is rarely captured, restricting this rule to tenants with expanded diagnostic logging.

level: low

T1526 Cloud Service Discovery

title: T1526 Cloud Service Discovery
id: 3246cee2-68db-42e9-b6f1-9d1219ff33fb
description: 'Detection Strategy for Cloud Service Discovery. (Data Component: Cloud Service Enumeration; baseline tier: fallback.) Tune using: MonitoredAppIntegrations, GeoLocationDeviation.'
references:
  - https://attack.mitre.org/techniques/T1526
author: Shahrukh Khan
date: 2026-05-16
license: MIT
tags:
  - attack.discovery
  - attack.t1526

logsource:
  product: m365
  service: unified

detection:
  selection:
    Operation:
      - 'Get-ManagementRoleAssignment'
      - 'Get-RoleGroup'

  condition: selection

falsepositives:
  - Legitimate administrative reporting of Exchange or SharePoint role group configurations.

level: low

Explore