T1580 — Cloud Infrastructure Discovery

Tactic: Discovery · Platforms: IaaS

An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-service (IaaS) environment. This includes compute service resources such as instances, virtual machines, and snapshots as well as resources of other services including the storage and…

Sigma detection rules (1)

T1580 Cloud Infrastructure Discovery

title: T1580 Cloud Infrastructure Discovery
id: 08b3ce0f-d5fb-4610-b407-124be7f6c8ba
description: 'Detection Strategy for Cloud Infrastructure Discovery. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UserContext, GeoLocation, TimeWindow, APIThreshold.'
references:
  - https://attack.mitre.org/techniques/T1580
author: Shahrukh Khan
date: 2026-01-29
license: MIT
tags:
  - attack.discovery
  - attack.t1580

logsource:
  category: cloudtrail
  product: aws

detection:
  selection_tooling:
    userAgent|contains:
      - 'pacu'
      - 'ScoutSuite'
      - 'cloudfox'
      - 'CloudMapper'

  condition: selection_tooling

falsepositives:
  - Authorized cloud security posture assessments using the same open source infrastructure enumeration tooling.

level: medium

Explore