| T1530_AWS | Data from Cloud Storage Object (AWS) | AWS | Collection | MITRE ATT&CK |
| T1537_AWS | Transfer Data to Cloud Account | AWS | Exfiltration | MITRE ATT&CK |
| T1619_AWS | Cloud Storage Object Discovery(AWS) | AWS | Discovery | MITRE ATT&CK |
| T1098.001_AWS | Account Manipulation: Additional Cloud Credentials | AWS | Persistence | MITRE ATT&CK |
| T1204.002_AWS | User Execution: Malicious File (AWS) | AWS | Execution | MITRE ATT&CK |
| T1552.005_AWS | Cloud Instance Metadata API | AWS | Credential Access | MITRE ATT&CK |
| T1648_AWS | Serverless Execution | AWS | Execution | MITRE ATT&CK |
| T1098.003_AWS | Account Manipulation: Additional Cloud Roles (AWS) | AWS | Collection | MITRE ATT&CK |
| T1087.004_AWS | Account Discovery: Cloud Account (AWS) | AWS | Discovery | MITRE ATT&CK |
| T1190_Aws | Exploit Public-Facing Application (Aws) | Aws | Initial Access, Persistence | MITRE ATT&CK |
| T1136.003_AWS | Create Account: Cloud Account | AWS | Persistence | MITRE ATT&CK |
| T1204_AWS | User Execution | AWS | Execution | MITRE ATT&CK |
| T1528_AWS | Steal Application Access Token (AWS) | AWS | Collection | MITRE ATT&CK |
| T1580_AWS | Cloud Infrastructure Discovery(AWS) | AWS | Discovery | MITRE ATT&CK |
| T1069.003_AWS | Permission Groups Discovery: Cloud Groups (AWS) | AWS | Discovery | MITRE ATT&CK |
