This article examines how attackers can exploit log data in cloud environments for enumeration and intelligence gathering. It discusses the types of logs generated by major cloud providers like AWS, Azure, and GCP, and highlights the importance of rethinking log access to enhance security. Practical mitigation strategies for defenders are also presented.

EvilMist is a set of scripts for auditing cloud security, focusing on Azure Entra ID. It helps identify misconfigurations, assess user access, and simulate attack techniques, all without needing authentication tokens. The toolkit includes features for user enumeration, risk assessment, and export options for analysis.