|
Threat Technique Catalog for AWS
Table of Contents
Home
Matrix
Tactics
TA0042: Resource Development
TA0001: Initial Access
TA0002: Execution
TA0003: Persistence
TA0004: Privilege Escalation
TA0005: Defense Evasion
TA0006: Credential Access
TA0007: Discovery
TA0008: Lateral Movement
TA0009: Collection
TA0040: Impact
Techniques
AT1023: Cloud Database Discovery
AT1023.001: Query RDS
AT1667: Application API Abuse
AT1667.001: API Gateway
T1059: Command and Scripting Interpreter
T1059.009: Cloud API
T1070: Indicator Removal
T1070.A001: Delete IAM Entities
T1078: Valid Accounts
T1078.A001: IAM Users
T1078.A002: Account Root User
T1087: Account Discovery
T1087.004: Cloud Account
T1098: Account Manipulation
T1098.001: Additional Cloud Credentials
T1098.003: Additional Cloud Roles
T1098.A001: AWS Support Case Closure
T1136: Create Account
T1136.003: Create Cloud Account
T1190: Exploit Public-Facing Application
T1190.A016: EC2 Hosted Application Compromise
T1190.A019: Overly Permissive VPC Security Groups
T1199: Trusted Relationship
T1199.A002: Role Assumption and Federated Access
T1213: Data from Information Repositories
T1213.A013: RDS Instance Manipulation
T1484: Domain or Tenant Policy Modification
T1484.002: Trust Modification
T1485: Data Destruction
T1485.001: Lifecycle-Triggered Deletion
T1485.A001: RDS Instances and Backups
T1485.A003: S3 Object and Bucket Deletion
T1486: Data Encrypted for Impact
T1486.A001: S3 Encryption - SSE-C Key Encryption
T1486.A002: EC2/EBS Data Encryption
T1486.A003: RDS Data Encryption
T1491: Defacement
T1491.A001: Subdomain Takeover
T1496: Resource Hijacking
T1496.001: Compute Hijacking
T1496.003: SMS Pumping
T1496.004: Cloud Service Hijacking
T1496.A001: Cloud Service Hijacking - SES Messaging
T1496.A006: Compute Hijacking - ECS
T1496.A007: Cloud Service Hijacking - Bedrock LLM Abuse
T1496.A008: Compute Hijacking - EC2 Use
T1496.A009: Compute Hijacking - WorkSpaces
T1530: Data from Cloud Storage
T1530.A001: S3 Object Collection
T1531: Account Access Removal
T1535: Unused/Unsupported Cloud Regions
T1538: Cloud Service Dashboard
T1552: Unsecured Credentials
T1552.001: Credentials In Files
T1552.005: Cloud Instance Metadata API
T1562: Impair Defenses
T1562.007: Disable or Modify Cloud Firewall
T1562.008: Disable Cloud Logs
T1562.A001: Disable or Modify GuardDuty
T1578: Modify Cloud Compute Infrastructure
T1578.001: Create Snapshot
T1578.002: Create Cloud Instance
T1578.003: Delete Cloud Instance
T1578.005: Modify Cloud Compute Configurations
T1583: Acquire Infrastructure
T1583.001: Domains
T1619: Cloud Storage Discovery
T1619.A001: S3 Object and Bucket Enumeration
T1648: Serverless Execution
T1648.A001: Invoking Lambda Function
T1648.A002: Malicious code from Compromised Third Party Packages
T1651: Cloud Administration Command
T1666: Modify Cloud Resource Hierarchy
T1666.A001: Create or Invite AWS Account
T1666.A002: Leave AWS Organization
AWS Services
AT1023: Cloud Database Discovery
AT1667: Application API Abuse
T1070: Indicator Removal
T1078: Valid Accounts
T1078.A002: Account Root User
T1087: Account Discovery
T1098: Account Manipulation
T1136: Create Account
T1190: Exploit Public-Facing Application
T1190.A016: EC2 Hosted Application Compromise
T1190.A019: Overly Permissive VPC Security Groups
T1199: Trusted Relationship
T1484: Domain or Tenant Policy Modification
T1485: Data Destruction
T1486: Data Encrypted for Impact
T1491: Defacement
T1496: Resource Hijacking
T1496.001: Compute Hijacking
T1496.004: Cloud Service Hijacking
T1530: Data from Cloud Storage
T1535: Unused/Unsupported Cloud Regions
T1552: Unsecured Credentials
T1552.001: Credentials In Files
T1562: Impair Defenses
T1578: Modify Cloud Compute Infrastructure
T1578.003: Delete Cloud Instance
T1578.005: Modify Cloud Compute Configurations
T1619: Cloud Storage Discovery
T1651: Cloud Administration Command
T1666: Modify Cloud Resource Hierarchy
AWS CloudShell
T1059.009: Cloud API
AWS CloudTrail
T1562.008: Disable Cloud Logs
AWS IAM Identity Center
T1087.004: Cloud Account
T1098.003: Additional Cloud Roles
T1136.003: Create Cloud Account
T1199.A002: Role Assumption and Federated Access
T1484.002: Trust Modification
AWS Identity and Access Management (IAM)
T1070.A001: Delete IAM Entities
T1078.A001: IAM Users
T1087.004: Cloud Account
T1098.001: Additional Cloud Credentials
T1098.003: Additional Cloud Roles
T1136.003: Create Cloud Account
T1484.002: Trust Modification
T1531: Account Access Removal
AWS Lambda
T1648.A001: Invoking Lambda Function
AWS Organizations
T1666.A001: Create or Invite AWS Account
T1666.A002: Leave AWS Organization
AWS Security Token Service (STS)
T1098.001: Additional Cloud Credentials
T1199.A002: Role Assumption and Federated Access
AWS Sign-In
T1538: Cloud Service Dashboard
Amazon API Gateway
AT1667.001: API Gateway
Amazon Bedrock
T1496.A007: Cloud Service Hijacking - Bedrock LLM Abuse
Amazon CloudWatch
T1562.008: Disable Cloud Logs
Amazon Cognito
T1496.003: SMS Pumping
Amazon Elastic Compute Cloud (EC2)
T1098.001: Additional Cloud Credentials
T1496.A008: Compute Hijacking - EC2 Use
T1552.005: Cloud Instance Metadata API
T1562.007: Disable or Modify Cloud Firewall
T1578.001: Create Snapshot
T1578.002: Create Cloud Instance
Amazon Elastic Container Service (ECS)
T1496.A006: Compute Hijacking - ECS
T1578.002: Create Cloud Instance
Amazon Elastic Kubernetes Service (EKS)
T1578.002: Create Cloud Instance
Amazon GuardDuty
T1562.A001: Disable or Modify GuardDuty
Amazon Relational Database Service (RDS)
AT1023.001: Query RDS
T1213.A013: RDS Instance Manipulation
T1485.A001: RDS Instances and Backups
Amazon Route 53
T1491.A001: Subdomain Takeover
T1583.001: Domains
Amazon Simple Email Service (SES)
T1496.A001: Cloud Service Hijacking - SES Messaging
Amazon Simple Notification Service (SNS)
T1496.003: SMS Pumping
Amazon Simple Storage Service (S3)
T1485.001: Lifecycle-Triggered Deletion
T1485.A003: S3 Object and Bucket Deletion
T1486.A001: S3 Encryption - SSE-C Key Encryption
T1530.A001: S3 Object Collection
T1619.A001: S3 Object and Bucket Enumeration
RDS
T1486.A003: RDS Data Encryption
All Tactics Index
All Techniques Index
All Services Index
Home
Techniques
Cloud Database Discovery
Cloud Database Discovery
AWS Specific Technique
Sub-techniques (3)
ID
Name
AT1023.001
Query RDS
MITRE ATT&CK Content
An adversary may attempt to discover resources that are available within database services.
References
Databases on AWS
Technique Information
ID:
AT1023
Aliases:
AT1023
Sub-techniques:
AT1023.001
Tactics:
Discovery
Platforms:
IaaS
Amazon Web Services (AWS)
Created:
07 Jun 2021
Last Modified:
03 Jun 2025