T1619 — Cloud Storage Object Discovery

Tactic: Discovery · Platforms: IaaS

Adversaries may enumerate objects in cloud storage infrastructure. Adversaries may use this information during automated discovery to shape follow-on behaviors, including requesting all or specific objects from cloud storage. Similar to File and Directory Discovery on a local host, after…

Sigma detection rules (1)

T1619 Cloud Storage Object Discovery

title: T1619 Cloud Storage Object Discovery
id: c749b440-2a65-45a4-9477-84661d610cc3
description: 'Detection Strategy for Cloud Storage Object Discovery. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TimeWindow, UserContext, RegionScope.'
references:
  - https://attack.mitre.org/techniques/T1619
author: Shahrukh Khan
date: 2026-02-01
license: MIT
tags:
  - attack.discovery
  - attack.t1619

logsource:
  category: cloudtrail
  product: aws

detection:
  selection_tooling:
    userAgent|contains:
      - 'pacu'
      - 'cloudfox'
      - 'S3Scanner'

  condition: selection_tooling

falsepositives:
  - Approved cloud security assessments or backup inventory scripts using the same S3 enumeration tooling.

level: medium

Explore