MITRE ATT&CK Technique
Discovery T1619
Description

Adversaries may enumerate objects in cloud storage infrastructure. Adversaries may use this information during automated discovery to shape follow-on behaviors, including requesting all or specific objects from cloud storage. Similar to [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) on a local host, after identifying available storage services (i.e. [Cloud Infrastructure Discovery](https://attack.mitre.org/techniques/T1580)) adversaries may access the contents/objects stored in cloud infrastructure. Cloud service providers offer APIs allowing users to enumerate objects stored within cloud storage. Examples include ListObjectsV2 in AWS (Citation: ListObjectsV2) and List Blobs in Azure(Citation: List Blobs) .

Supported Platforms
IaaS
Created

April 29, 2026

Last Updated

April 29, 2026

STIX Data
{'created': '2021-10-01T17:58:26.445Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': 'Adversaries may enumerate objects in cloud storage '
                'infrastructure. Adversaries may use this information during '
                'automated discovery to shape follow-on behaviors, including '
                'requesting all or specific objects from cloud storage.  '
                'Similar to [File and Directory '
                'Discovery](https://attack.mitre.org/techniques/T1083) on a '
                'local host, after identifying available storage services '
                '(i.e. [Cloud Infrastructure '
                'Discovery](https://attack.mitre.org/techniques/T1580)) '
                'adversaries may access the contents/objects stored in cloud '
                'infrastructure.\n'
                '\n'
                'Cloud service providers offer APIs allowing users to '
                'enumerate objects stored within cloud storage. Examples '
                'include ListObjectsV2 in AWS (Citation: ListObjectsV2) and '
                'List Blobs in Azure(Citation: List Blobs) .',
 'external_references': [{'external_id': 'T1619',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/techniques/T1619'},
                         {'description': 'Amazon - ListObjectsV2. Retrieved '
                                         'October 4, 2021.',
                          'source_name': 'ListObjectsV2',
                          'url': 'https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectsV2.html'},
                         {'description': 'Microsoft - List Blobs. (n.d.). '
                                         'Retrieved October 4, 2021.',
                          'source_name': 'List Blobs',
                          'url': 'https://docs.microsoft.com/en-us/rest/api/storageservices/list-blobs'}],
 'id': 'attack-pattern--8565825b-21c8-4518-b75e-cbc4c717a156',
 'kill_chain_phases': [{'kill_chain_name': 'mitre-attack',
                        'phase_name': 'discovery'}],
 'modified': '2025-10-24T17:49:03.853Z',
 'name': 'Cloud Storage Object Discovery',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': False,
 'spec_version': '2.1',
 'type': 'attack-pattern',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_contributors': ['Regina Elwell', 'Isif Ibrahima, Mandiant'],
 'x_mitre_deprecated': False,
 'x_mitre_detection': '',
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_is_subtechnique': False,
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_platforms': ['IaaS'],
 'x_mitre_version': '1.0'}
Quick Actions