Cloud Service Discovery
Cloud service discovery enumerates available managed services after access.
What it means
Cloud service discovery enumerates available managed services after access. The resulting inventory can guide data collection, execution, or privilege targeting.
An investigation example
A compromised identity lists services and then queries an unfamiliar storage or automation resource.
Evidence to examine
Review audit records, caller permissions, enumeration scope, and actions performed on the discovered resources.
A common analytical pitfall
Listing services does not prove data collection or administrative changes occurred.
Response considerations
Preserve the audit sequence and investigate effective resource access and follow-on actions under the affected identity.
Service availability differs from resource enumeration
Cloud-service discovery identifies which managed services or capabilities are available in an environment. Infrastructure discovery focuses more specifically on resources within those services. The distinction helps describe what an identity learned: finding that a database service is used is not the same as listing its instances or reading their contents.
Management and cost tools legitimately inspect service use. Review the requesting identity, account or project scope, expected job, and subsequent activity. A new session enumerating several unrelated services may merit investigation, while a scheduled inventory process may produce a similar pattern for an approved purpose. The name of the API alone does not settle intent.
A fictional unfamiliar service map
An academy's cloud logs show an identity exploring services it normally never uses, followed by resource queries in one of them. Analysts preserve the session context and outcomes and compare the sequence with approved changes. The service-level discovery may explain how the later target was selected, but it does not establish access to protected data.
Provider logging and permissions affect visibility. Some requests may be recorded differently, and an empty result may mean no resources, insufficient permission, or a narrower query scope. Understand the actual response before describing the environment. A broad conclusion about the whole organization should not rest on one project's query.
Label a short sequence
Create fictional events for listing available services, listing database instances, and attempting a database operation. Assign a precise description to each and state the claim supported by its outcome. Then identify what evidence would demonstrate successful data access. Use a paper scenario or an authorized training account.
A useful access review asks whether the identity needs service-discovery visibility for its job, not only whether it can modify resources. At the same time, removing visibility indiscriminately can break legitimate monitoring and support. Match the permission decision to purpose and verify the effect through a controlled process.
Related concepts
References & further reading
Original explanations, with primary references for deeper study.
MITRE ATT&CK T1526: Cloud Service Discovery