Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →An adversary may attempt to enumerate the cloud services running on a system after gaining access.
.claude/skills/cyberstrikeus-t1526-cloud-service-discovery/SKILL.md| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-09 | ✗→✓ | ▲ Improved | 42% | 0% |
| case-02 | ✗→✓ | ▲ Improved | 31% | 0% |
| case-04 | ✗→✓ | ▲ Improved | -14% | 0% |
| case-06 | ✗→✓ | ▲ Improved | 22% | 0% |
| case-13 | ✗→✓ | ▲ Improved | -66% | 0% |
An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Entra ID, etc. They may also include security services, such as AWS GuardDuty and Microsoft Defender for Cloud, and logging services, such as AWS CloudTrail and Google Cloud Audit Logs.
Adversaries may attempt to discover information about the services enabled throughout the environment. Azure tools and APIs, such as the Microsoft Graph API and Azure Resource Manager API, can enumerate resources and services, including applications, management groups, resources and policy definitions, and their relationships that are accessible by an identity.
For example, Stormspotter is an open source tool for enumerating and constructing a graph for Azure resources and services, and Pacu is an open source AWS exploitation framework that supports several methods for discovering cloud services.
Adversaries may use the information gained to shape follow-on behaviors, such as targeting data or credentials from enumerated services or evading identified defenses through Disable or Modify Tools or Disable or Modify Cloud Logs.
Platforms: IaaS, Identity Provider, Office Suite, SaaS
> Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
No specific mitigations documented for this technique.
| Finding | Severity | Impact | | -------------------------------------------- | -------- | --------- | | Cloud Service Discovery technique applicable | High | Discovery |
| CWE ID | Title | | ------- | --------------------------------- | | CWE-200 | Exposure of Sensitive Information |
| Case | Status | Duration (ms) | Turns | Tokens | Tool calls | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Without | With | Δ | Without | With | Δ | Without | With | Δ | Without | With | Δ | ||
case-09 | fail→pass | 25,778 | 22,725 | -12% | 1 | 1 | 0% | 3,301 | 4,687 | +42% | 0 | 0 | — |
case-01 | fail→fail | 34,810 | 36,158 | +4% | 1 | 1 | 0% | 4,986 | 5,340 | +7% | 0 | 0 | — |
case-02 | fail→pass | 22,395 | 29,632 | +32% | 1 | 1 | 0% | 3,797 | 4,983 | +31% | 0 | 0 | — |
case-03 | fail→fail | 28,225 | 30,971 | +10% | 1 | 1 | 0% | 3,548 | 5,208 | +47% | 0 | 0 | — |
case-04 | fail→pass | 20,728 | 17,444 | -16% | 1 | 1 | 0% | 2,943 | 2,521 | -14% | 0 | 0 | — |
case-05 | fail→fail | 8,927 | 10,308 | +15% | 1 | 1 | 0% | 1,681 | 2,570 | +53% | 0 | 0 | — |
case-06 | fail→pass | 11,682 | 15,133 | +30% | 1 | 1 | 0% | 2,067 | 2,521 | +22% | 0 | 0 | — |
case-07 | pass→pass | 16,725 | 10,604 | -37% | 1 | 1 | 0% | 1,986 | 1,827 | -8% | 0 | 0 | — |
case-08 | pass→pass | 6,662 | 5,293 | -21% | 1 | 1 | 0% | 1,182 | 1,700 | +44% | 0 | 0 | — |
case-10 | fail→fail | 22,024 | 17,534 | -20% | 1 | 1 | 0% | 2,643 | 3,606 | +36% | 0 | 0 | — |
case-11 | fail→fail | 26,539 | 25,347 | -4% | 1 | 1 | 0% | 3,721 | 4,291 | +15% | 0 | 0 | — |
case-12 | fail→fail | 25,128 | 21,917 | -13% | 1 | 1 | 0% | 3,234 | 3,954 | +22% | 0 | 0 | — |
case-13 | fail→pass | 19,126 | 2,044 | -89% | 1 | 1 | 0% | 3,110 | 1,054 | -66% | 0 | 0 | — |
case-14 | pass→pass | 23,305 | 19,722 | -15% | 1 | 1 | 0% | 2,803 | 3,302 | +18% | 0 | 0 | — |
case-15 | pass→pass | 20,744 | 11,978 | -42% | 1 | 1 | 0% | 2,833 | 2,068 | -27% | 0 | 0 | — |
case-16 | fail→pass | 13,273 | 9,988 | -25% | 1 | 1 | 0% | 2,359 | 1,762 | -25% | 0 | 0 | — |
case-17 | pass→pass | 11,040 | 8,165 | -26% | 1 | 1 | 0% | 882 | 1,144 | +30% | 0 | 0 | — |
case-18 | pass→pass | 15,959 | 7,181 | -55% | 1 | 1 | 0% | 1,806 | 1,089 | -40% | 0 | 0 | — |
case-19 | pass→pass | 13,712 | 9,834 | -28% | 1 | 1 | 0% | 2,211 | 1,200 | -46% | 0 | 0 | — |
case-20 | fail→pass | 11,636 | 9,440 | -19% | 1 | 1 | 0% | 1,166 | 1,397 | +20% | 0 | 0 | — |
case-21 | pass→pass | 11,535 | 16,303 | +41% | 1 | 1 | 0% | 1,955 | 2,536 | +30% | 0 | 0 | — |
case-22 | pass→pass | 10,473 | 11,903 | +14% | 1 | 1 | 0% | 1,945 | 2,124 | +9% | 0 | 0 | — |
case-23 | fail→pass | 19,884 | 17,952 | -10% | 1 | 1 | 0% | 2,470 | 2,923 | +18% | 0 | 0 | — |
DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +35 percentage points is the difference between those two pass rates over the 23 comparable cases. 1 case got worse with the skill loaded, and it is included in that figure.
Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.
Other measured skills in the registry, with their headline benchmark lift.