A responder is analyzing a MITRE-related alert and sees the technique ' Explore > Discovery...

An adversary uses an automated script to bruteforce S3 bucket permissions.

An adversary uses a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment.

An adversary executes an API call to terminate all running EC2 instances in a region.

An adversary deploys a crypto-miner inside a compromised Docker container.