Storage service discovery

Info

ID: MS-T820
Tactic: Discovery
MITRE technique:

Attackers may leverage access permission to explore the stored objects in the storage account. Tools witnessed, at the reconnaissance phase, are oftentimes used toward this post-compromise information-gathering objective, now with authorization to access storage APIs, such as the List Blobs call.