Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1619_cloud-storage-object-discovery
Adversaries may enumerate objects in cloud storage infrastructure.
Passed 22 of 22 test cases with the skill, and 20 of 22 without it.
2 fixed20 passed either way0 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
An attacker created new unauthorized S3 buckets in our AWS account to host exfiltrated files. We need the MITRE ATT&CK technique code for unauthorized cloud storage provisioning or resource creation.
| Checked | Without skill | With skill |
|---|---|---|
| Identifies MITRE ATT&CK technique T1496. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may enumerate objects in cloud storage infrastructure. Adversaries may use this information during automated discovery to shape follow-on behaviors, including requesting all or specific objects from cloud storage. Similar to File and Directory Discovery on a local host, after identifying available storage services (i.e. Cloud Infrastructure Discovery) adversaries may access the contents/objects stored in cloud infrastructure.
Cloud service providers offer APIs allowing users to enumerate objects stored within cloud storage. Examples include ListObjectsV2 in AWS and List Blobs in Azure .
Platforms: IaaS
Identify Attack Surface: Determine if the target environment is susceptible to Cloud Storage Object Discovery by examining the target platforms (IaaS).
Assess Existing Defenses: Review whether mitigations for T1619 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
Restrict granting of permissions related to listing objects in cloud storage to necessary accounts.
test cases passed, vs 20 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.