T1619

Cloud Storage Object Discovery

IaaS1 piece on this siteT1619 on attack.mitre.org

Adversaries may enumerate objects in cloud storage infrastructure. Adversaries may use this information during automated discovery to shape follow-on behaviors, including requesting all or specific objects from cloud storage. Similar to File and Directory Discovery on a local host, after identifying available storage services (i.e. Cloud Infrastructure Discovery) adversaries may access the contents/objects stored in cloud infrastructure.
MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

Checklists and playbooks to open while the alert is still live.

First-hour playbookMembers

Company data in a public storage bucket

A researcher, a journalist or a scanner reports a storage bucket, blob container or shared link that anybody on the internet can read.

T1619

how MITRE says to see it

Detection Strategy for Cloud Storage Object Discovery

Detection of suspicious enumeration of cloud storage objects via API calls such as AWS S3 ListObjectsV2, Azure List Blobs, or GCP ListObjects. Correlate access with account role, user context, and prior authentication activity to identify anomalous usage patterns (e.g., unusual account, unexpected regions, or...

what reduces it

M1018 User Account Management. Restrict granting of permissions related to listing objects in cloud storage to necessary accounts.

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.