Cloud Storage Object Discovery (T1619) is a Discovery technique on IaaS. Adversaries enumerate the objects in cloud storage so they can choose what to read. After finding storage services through Cloud Infrastructure Discovery, they look inside.
How attackers use it
MITRE compares this to File and Directory Discovery on a local host. Cloud providers offer APIs to list stored objects, and MITRE names ListObjectsV2 in AWS and List Blobs in Azure. The results shape follow-on behavior, including requests for all or specific objects.
Tools listed on the page include Pacu, which can enumerate AWS storage services, Peirates, which can list S3 buckets, and TruffleHog, which can enumerate cloud storage in AWS S3 and Google Cloud Storage. ShinyHunters is listed as having used S3 Browser and WinSCP to access S3 objects.
How to detect it
MITRE's analytic looks for suspicious enumeration through API calls such as ListObjectsV2, List Blobs and GCP ListObjects. Correlate each with the account's role, user context and earlier authentication to find odd patterns: an unusual account, an unexpected region, or large scale enumeration in a short window.
Make sure the logging exists first. Enable object level logging for sensitive buckets, such as server access logs or provider audit logs for storage, and send them to a store the storage account itself cannot alter.
How to reduce the risk
MITRE's mitigation is User Account Management: restrict the permissions that allow listing objects in cloud storage to the accounts that need them. Where an application only reads known keys, it does not need list permission at all.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which permission does MITRE say to restrict?
Permissions related to listing objects in cloud storage, limited to the accounts that need them.
