Home/ MITRE Matrix/ Discovery/ T1580

T1580Cloud Infrastructure Discovery

T1580 — Cloud Infrastructure Discovery is a MITRE ATT&CK technique in the Discovery tactic. Clankerusecase tracks 7 detection use cases covering it and 2 threat-intel articles citing it.

Discovery

View on the matrix → Filter Detection Library MITRE official spec ↗

7Use cases

2Articles

0Sub-techniques

1Tactic

Use cases covering this technique (7)

ASL AWS IAM AccessDenied Discovery Events ESCU actions · hunting P ASL AWS IAM Assume Role Policy Brute Force ESCU actions · alerting P AWS Bedrock High Number List Foundation Model Failures ESCU actions · alerting P AWS IAM AccessDenied Discovery Events ESCU actions · hunting P AWS IAM Assume Role Policy Brute Force ESCU actions · alerting P [LLM] Vulnerable Logging operator (CVE-2026-54680) present in inventory Bespoke recon · hunting DS [LLM] WAF-Role mass S3 bucket enumeration and object download Bespoke actions · alerting PDDCW

Articles citing this technique (2)

crit [GHSA / CRITICAL] CVE-2026-54680: Logging operator has Fluentd configuration injection that allows remote code execution art-08

high A technical analysis of the Capital One cloud misconfiguration breach art-3495