T1619 — Cloud Storage Object Discovery

# T1619 - Cloud Storage Object Discovery

## SOC Recommendation
Investigate Cloud Storage Object Discovery activity in the context of Discovery: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Disk Encryption | Harden | Apply Disk Encryption to reduce this technique's viability before an incident occurs. |
| Disk Formatting | Evict | Use Disk Formatting to remove the adversary's foothold once this technique is confirmed. |
| Hardware Component Inventory | Model | Use Hardware Component Inventory to establish a baseline that makes this technique's deviations easier to spot. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Contain the affected host or account | Medium | No | Yes |
| Collect and preserve evidence | Low | Yes | No |

## KQL
```kql
TheomAlerts_CL
 | where priority_s == "P1"
```
```kql
TheomAlerts_CL
 | where priority_s == "P2"
```
```kql
TheomAlerts_CL
 | where priority_s == "P4"
```

## Escalation Criteria
- Cloud Storage Object Discovery activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1619.json
• /api/recommendations/T1619.json
• /api/d3fend/T1619.json
• /api/mappings/T1619.json
• /api/confluence/T1619.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1619.json

Response:

{
  "technique_id": "T1619",
  "name": "Cloud Storage Object Discovery",
  "priority": "high",
  "status": "draft",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Discovery"
  ],
  "platforms": [
    "IaaS"
  ],
  "summary": "Adversaries may enumerate objects in cloud storage infrastructure. Adversaries may use this information during automated discovery to shape follow-on behaviors, including requesting all or specific objects from cloud storage. Similar to [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) on a local host, after identifying available storage services (i.e...",
  "soc_recommendation": "Investigate Cloud Storage Object Discovery activity in the context of Discovery: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-DENCR",
      "name": "Disk Encryption",
      "relationship": "harden",
      "practical_action": "Apply Disk Encryption to reduce this technique's viability before an incident occurs.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-DKF",
      "name": "Disk Formatting",
      "relationship": "evict",
      "practical_action": "Use Disk Formatting to remove the adversary's foothold once this technique is confirmed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-HCI",
      "name": "Hardware Component Inventory",
      "relationship": "model",
      "practical_action": "Use Hardware Component Inventory to establish a baseline that makes this technique's deviations easier to spot.",
      "tooling": [
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.",
      "Check Sentinel analytics rules and incidents correlated with this technique.",
      "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource."
    ],
    "generic": [
      "Confirm whether the observed cloud storage object discovery activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"Theom Critical Risks\" -- \"Creates Microsoft Sentinel incidents for critical risk Theom alerts.\""
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Contain the affected host or account",
      "category": "Containment",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "Defender for Endpoint / Entra ID",
      "notes": "Requires approval -- confirm malicious intent before isolating a host or disabling an account."
    },
    {
      "name": "Collect and preserve evidence",
      "category": "Investigation",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "Defender for Endpoint",
      "notes": "Safe -- read-only evidence collection."
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "bb9051ef-0e72-4758-a143-80c25ee452f0 — Theom Critical Risks",
        "description": "\"Creates Microsoft Sentinel incidents for critical risk Theom alerts.\" (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "TheomAlerts_CL\n | where priority_s == \"P1\""
      },
      {
        "name": "74b80987-0a62-448c-8779-47b02e17d3cf — Theom High Risks",
        "description": "\"Creates Microsoft Sentinel incidents for high risk Theom alerts.\" (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "TheomAlerts_CL\n | where priority_s == \"P2\""
      },
      {
        "name": "cf7fb616-ac80-40ce-ad18-aa18912811f8 — Theom Low Risks",
        "description": "\"Creates Microsoft Sentinel incidents for low risk Theom alerts\" (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "TheomAlerts_CL\n | where priority_s == \"P4\""
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "a7577205-88a1-4a08-85d4-7b72a9a2e969 — AWS S3 Rapid Bucket Posture API Calls from a Single Principal",
        "description": "(ESQL) Identifies when the same AWS principal, from the same source IP, successfully invokes read-only S3 control-plane APIs that reveal bucket posture across many buckets in a short period. This pattern can indicate automated reconnaissance or security scanning, similar to CSPM tools and post-compromise enumeration... (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "from logs-aws.cloudtrail-* metadata _id, _version, _index\n| eval Esql.time_window_date_trunc = date_trunc(10 seconds, @timestamp)\n\n| where\n    data_stream.dataset == \"aws.cloudtrail\"\n    and event.provider == \"s3.amazonaws.com\"\n    and event.outcome == \"success\"\n    and event.action in (\n      \"GetBucketAcl\",\n      \"GetBucketPublicAccessBlock\",\n      \"GetBucketPolicy\",\n      \"GetBucketPolicyStatus\",\n      \"GetBucketVersioning\"\n    )\n    and aws.cloudtrail.user_identity.type != \"AWSService\"\n    and source.ip IS NOT NULL\n    and aws.cloudtrail.resources.arn IS NOT NULL\n    and aws.cloudtrail.user_identity.arn IS NOT NULL\n    and aws.cloudtrail.session_credential_from_console IS NULL\n\n| keep\n    @timestamp,\n    Esql.time_window_date_trunc,\n    event.action,\n    aws.cloudtrail.user_identity.arn,\n    aws.cloudtrail.user_identity.type,\n    aws.cloudtrail.user_identity.access_key_id,\n    source.ip,\n    aws.cloudtrail.resources.arn,\n    cloud.account.id,\n    cloud.region,\n    user_agent.original,\n    source.as.organization.name,\n    data_stream.namespace\n\n| stats\n    Esql.aws_cloudtrail_resources_arn_count_distinct = count_distinct(aws.cloudtrail.resources.arn),\n    Esql.aws_cloudtrail_resources_arn_values = VALUES(aws.cloudtrail.resources.arn),\n    Esql.event_action_values = VALUES(event.action),\n    Esql.timestamp_values = VALUES(@timestamp),\n    Esql.aws_cloudtrail_user_identity_type_values = VALUES(aws.cloudtrail.user_identity.type),\n    Esql.aws_cloudtrail_user_identity_access_key_id_values = VALUES(aws.cloudtrail.user_identity.access_key_id),\n    Esql.cloud_account_id_values = VALUES(cloud.account.id),\n    Esql.cloud_region_values = VALUES(cloud.region),\n    Esql.user_agent_original_values = VALUES(user_agent.original),\n    Esql.source_as_organization_name_values = VALUES(source.as.organization.name),\n    Esql.data_stream_namespace_values = VALUES(data_stream.namespace)\n  by Esql.time_window_date_trunc, aws.cloudtrail.user_identity.arn, source.ip\n\n| where Esql.aws_cloudtrail_resources_arn_count_distinct > 15\n\n| keep\n    aws.cloudtrail.user_identity.arn,\n    source.ip,\n    Esql.time_window_date_trunc,\n    Esql.aws_cloudtrail_resources_arn_count_distinct,\n    Esql.aws_cloudtrail_resources_arn_values,\n    Esql.event_action_values,\n    Esql.timestamp_values,\n    Esql.aws_cloudtrail_user_identity_type_values,\n    Esql.aws_cloudtrail_user_identity_access_key_id_values,\n    Esql.cloud_account_id_values,\n    Esql.cloud_region_values,\n    Esql.user_agent_original_values,\n    Esql.source_as_organization_name_values,\n    Esql.data_stream_namespace_values"
      },
      {
        "name": "4f2654e4-125b-11f1-af7d-f661ea17fbce — M365 SharePoint Search for Sensitive Content",
        "description": "(EQL) Identifies search queries in SharePoint containing sensitive terms related to credentials, financial data, PII, legal matters, or infrastructure information. Adversaries who compromise user accounts often search for high-value files before exfiltration... (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "web where data_stream.dataset == \"o365.audit\" and\n    event.provider == \"SharePoint\" and\n    event.action == \"SearchQueryPerformed\" and\n    event.outcome == \"success\" and\n    o365.audit.SearchQueryText != null and\n    o365.audit.SearchQueryText != \"\" and\n    o365.audit.SearchQueryText like~ (\n        /* Credentials and Secrets */\n        \"*password*\", \"*credential*\", \"*secret*\", \"*api key*\", \"*apikey*\",\n        \"*token*\", \"*private key*\", \"*certificate*\", \"*ssh*\", \"*aws*\",\n        \"*azure*\", \"*gcp*\", \"*oauth*\", \"*bearer*\", \"*connection string*\",\n        \"*access key*\", \"*secret key*\",\n        /* Financial */\n        \"*salary*\", \"*payroll*\", \"*compensation*\", \"*budget*\", \"*revenue*\",\n        \"*financial*\", \"*banking*\", \"*invoice*\", \"*wire transfer*\", \"*account number*\",\n        \"*credit card*\", \"*routing number*\", \"*profit*\", \"*expense*\", \"*1099*\",\n        /* Legal and Compliance */\n        \"*confidential*\", \"*privileged*\", \"*attorney*\", \"*legal hold*\", \"*settlement*\",\n        \"*contract*\", \"*nda*\", \"*merger*\", \"*acquisition*\", \"*litigation*\",\n        \"*subpoena*\", \"*trade secret*\", \"*intellectual property*\", \"*proprietary*\",\n        \"*internal*\", \"*proposal*\", \"*poc*\",\n        /* HR and PII */\n        \"*ssn*\", \"*social security*\", \"*employee*\", \"*personnel*\", \"*performance review*\",\n        \"*termination*\", \"*tax*\", \"*w2*\", \"*benefits*\", \"*background check*\",\n        \"*medical*\", \"*hipaa*\", \"*passport*\", \"*driver license*\", \"*dob*\",\n        /* Infrastructure and IT */\n        \"*admin*\", \"*root*\", \"*vpn*\", \"*firewall*\", \"*network diagram*\",\n        \"*architecture*\", \"*topology*\", \"*production*\", \"*database*\", \"*config*\",\n        \"*backup*\", \"*disaster recovery*\", \"*vulnerability*\", \"*pentest*\", \"*security audit*\",\n        \"*salesforce*\"\n    )"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Cloud Storage Object Discovery activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate administrative or maintenance activity matching this pattern.",
    "Approved security testing or red team exercise.",
    "Known benign software producing similar telemetry."
  ],
  "confluence": {
    "title": "T1619 - Cloud Storage Object Discovery Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}