Skip to content

Cloud service discovery

Info

ID: MS-TA7021
Tactic: Discovery
MITRE technique: T1526

Cloud‑hosted applications often contain configuration values or runtime information that reference other cloud services the application interacts with, such as Service URL, API endpoints. After gaining access to a web application, attackers can discover additional cloud resources through environment variables, network connections or application code.

Mitigations

ID Mitigation Description
MS-M7035 Use private networking for service communication Connect cloud services via private endpoints, VPC peering, or VNET integration to avoid exposing service URLs.