Authorized collection testing against Amazon S3 using the AWS CLI. Listing buckets returns buckets owned by the authenticated account, not every bucket the identity could access. Object listing requires separate s3:ListBucket permission, and retrieving an object requires s3:GetObject. The download example is restricted to one explicitly approved, non-sensitive canary object. This aligns with MITRE ATT&CK T1530 Data from Cloud Storage (Collection).
Check before starting: RESTRICTED_ACCESS_BLUR_MARKER
Variant:
Full outcome coverage
GraphAPI · Enumerate User Profile Information
Enumerate User Profile Information
powershell
RESTRICTED_ACCESS_BLUR_MARKER
Version: RESTRICTED_ACCESS_BLUR_MARKER. Requirements: ALL(RESTRICTED_ACCESS_BLUR_MARKER)Documents all requested outcomes. This is a candidate, not proof of execution or compatibility.preconditions: RESTRICTED_ACCESS_BLUR_MARKERdependencies: RESTRICTED_ACCESS_BLUR_MARKERverification: RESTRICTED_ACCESS_BLUR_MARKERlimitations: RESTRICTED_ACCESS_BLUR_MARKER