Cloud Storage Object Discovery
Technique · ATTACK:enterprise:T1619
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1619",
"title": "Cloud Storage Object Discovery",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1619",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--8565825b-21c8-4518-b75e-cbc4c717a156",
"external_id": "T1619",
"domain": "enterprise",
"created": "2021-10-01T17:58:26.445Z",
"modified": "2026-05-12T15:12:00.685Z",
"version": "1.0",
"aliases": [
],
"tactics": [
"discovery"
],
"source_references": [
{
"source_name": "ListObjectsV2",
"url": "https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectsV2.html"
},
{
"source_name": "List Blobs",
"url": "https://docs.microsoft.com/en-us/rest/api/storageservices/list-blobs"
}
]
}Explicit source assertions (5)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1619
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1a5f8d73-a9c4-40db-9cd5-7f8a7aea19d7
ATTACK:enterprise:S9009 → uses → ATTACK:enterprise:T1619
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2286eded-7606-46df-a469-c5240f21ed75
Black Hills Information Security TruffleHog January 2024 · Github TruffleSecurity Trufflehog April 2025ATTACK:enterprise:S1091 → uses → ATTACK:enterprise:T1619
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--64d9fee3-d0c8-40e5-b295-d43ec719bb81
GitHub PacuATTACK:enterprise:S0683 → uses → ATTACK:enterprise:T1619
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9f2ee173-a4b2-45d9-8dfe-537f1fc82ef4
Peirates GitHubATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1619
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f3a9dfb6-a028-4f80-8823-32b43c9a3fc2
Unit42KelleyVaya_BlingLibra_Aug2024