# T1580 - Cloud Infrastructure Discovery

## SOC Recommendation
Investigate Cloud Infrastructure Discovery activity in the context of Discovery: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Network Traffic Analysis | Detect | Monitor for Network Traffic Analysis indicators relevant to this technique. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Identify the tool making the requests (Azure CLI, SDK, custo | Low | No | Yes |
| Revoke the credentials used if compromise confirmed | Medium | No | Yes |
| Enable Azure Defender for Key Vault and Storage | Low | No | Yes |

## KQL
```kql
AzureActivity
| where TimeGenerated >= ago(1h)
| where OperationNameValue has_any ("list", "List", "get", "Get", "read", "Read")
| where ResourceProviderValue has_any (
    "Microsoft.KeyVault", "Microsoft.Storage", "Microsoft.Compute",
    "Microsoft.Sql", "Microsoft.Authorization", "Microsoft.Network"
)
| summarize
    StartTime = min(TimeGenerated),
    EndTime = max(TimeGenerated),
    ReadCount = count(),
    ResourceTypes = dcount(ResourceProviderValue),
    Operations = make_set(OperationNameValue, 10)
    by Caller, CallerIpAddress, SubscriptionId
| where ReadCount > 50 and ResourceTypes > 3
| extend timestamp = StartTime, AccountCustomEntity = Caller, IPCustomEntity = CallerIpAddress
| order by ReadCount desc
```
```kql
Authomize_v2_CL
| where ingestion_time() >= ago(30m)
| extend EventID = id_s, Policy = policy_name_s, Severity = severity_s,Description = description_s,Recommendation = recommendation_s,URL = url_s,Tactics = tactics_s
| where Policy has "Privileged Machines Exposed to the Internet"
| project  EventID, Policy, Severity, Description, Recommendation, URL, Category, Tactics
```
```kql
let discoveryRecords = FortyTwoCrunchAPIProtection
| where TimeGenerated >= ago(5m) 
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid 
| where Status == 404 and ErrorMessage startswith "path not defined in OAS";
let discoveryCnt = (toscalar(discoveryRecords | count));
let recCount = iff((discoveryCnt > 500), 1, 0);
discoveryRecords | top recCount by Timestamp desc
```

## Escalation Criteria
- Cloud Infrastructure Discovery activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.